Skip to content

Test artifact attestation

Attest test fixtures, evaluation outputs, and Playwright snapshots so downstream consumers can verify exactly what was tested.

Test artifact attestation

Vitrified attestation isn't only for release binaries. It's useful any time you need to prove later that a specific byte sequence existed at a specific moment — including test artifacts.

Common cases:

  • Playwright snapshots — attest the snapshot images so changes are auditable.
  • AI evaluation results — attest the eval dataset, the model output, and the scoring result together so the eval is reproducible and the result is independently verifiable.
  • Regression fixtures — attest the input fixture + expected output so the regression test contract is provable.
  • Compliance artifacts — attest auditor-requested reports (SOC 2 evidence, GDPR data-mapping outputs, etc.) so the auditor sees a verifiable timestamp on the artifact they reviewed.

Pattern: attest the artifact inline in your test

import { test, expect } from "@playwright/test";
import { Vitrified } from "@vitrified/sdk";

const vitrified = new Vitrified({ apiKey: process.env.VITRIFIED_API_KEY });

test("homepage renders with the expected hero copy", async ({ page }) => {
  await page.goto("/");

  // Capture a screenshot artifact.
  const screenshot = await page.screenshot({ path: "./test-results/homepage.png" });

  // Attest the artifact as part of the test record.
  const digest = await vitrified.hashBytes(screenshot);
  const submission = await vitrified.attestations.create({
    artifact: { sha256: digest },
    metadata: {
      schema: "generic",
      kind: "playwright.screenshot",
      test: "homepage renders with the expected hero copy",
      ci_run: process.env.GITHUB_RUN_ID ?? "local",
      commit: process.env.GITHUB_SHA ?? "local",
    },
    idempotencyKey: `screenshot:homepage:${process.env.GITHUB_RUN_ID ?? "local"}`,
  });

  console.log(`Attested screenshot: ${submission.id}`);
  await expect(page.getByRole("heading", { level: 1 })).toContainText("Vitrified");
});

The idempotencyKey ensures the same CI run doesn't double-attest if the test is retried.

Pattern: attest fixtures alongside the test run

For larger fixtures (test datasets, evaluation outputs, golden files), attest them once per CI run rather than per test:

import { globalSetup } from "@playwright/test";
import { Vitrified } from "@vitrified/sdk";

export default async function () {
  const vitrified = new Vitrified({ apiKey: process.env.VITRIFIED_API_KEY });
  const digest = await vitrified.hashFile("./test/fixtures/dataset.tar.gz");

  await vitrified.attestations.create({
    artifact: { sha256: digest },
    metadata: {
      schema: "generic",
      kind: "test.fixture",
      name: "playwright-dataset",
      version: process.env.FIXTURE_VERSION,
    },
    idempotencyKey: `fixture:playwright-dataset:${process.env.FIXTURE_VERSION}`,
  });
}

Pattern: attest AI evaluation outputs

For model evaluations where downstream consumers need to confirm "this model output came from this input on this date":

from vitrified import Vitrified

vitrified = Vitrified(api_key=os.environ["VITRIFIED_API_KEY"])

# Attest the eval dataset.
dataset_digest = await vitrified.hash_file("./eval/dataset.jsonl")
dataset_sub = await vitrified.attestations.create(
    artifact={"sha256": dataset_digest},
    metadata={
        "schema": "generic",
        "kind": "ai.eval.dataset",
        "name": "regression-suite-q3",
        "size_records": 10_000,
    },
)

# Run the eval and write outputs.
outputs = run_eval("./eval/dataset.jsonl")
write_jsonl("./eval/outputs.jsonl", outputs)

# Attest the outputs, referencing the dataset attestation by submission ID.
outputs_digest = await vitrified.hash_file("./eval/outputs.jsonl")
await vitrified.attestations.create(
    artifact={"sha256": outputs_digest},
    metadata={
        "schema": "generic",
        "kind": "ai.eval.output",
        "model": "claude-sonnet-4-6",
        "dataset_submission": dataset_sub.id,
        "score": 0.94,
    },
)

A downstream consumer can fetch both bundles, verify them, and confirm that the output was produced from that exact dataset by that model.

See also

Was this page helpful?