GitHub Action
Drop-in CI attestation for releases. banchelabs/vitrified-action hashes your artifact, submits it, and emits the proof bundle as a workflow artifact.
GitHub Action
banchelabs/vitrified-action is the official GitHub Action for attestation in CI. It hashes a
local artifact (or set of artifacts), submits each to the Vitrified API with metadata derived
from the workflow context (commit SHA, ref, run number, builder identity), and emits the proof
bundle as a workflow artifact.
Minimum example
name: Release
on:
push:
tags: ["v*"]
jobs:
release:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- name: Build
run: ./scripts/build.sh
- name: Attest the release archive
uses: banchelabs/vitrified-action@v1
with:
api-key: ${{ secrets.VITRIFIED_API_KEY }}
artifact: ./dist/release.tar.gz
schema: slsa.provenance.v1The action emits the proof bundle as a workflow artifact named vitrified-bundle-<sha>.json.
Multiple artifacts
- uses: banchelabs/vitrified-action@v1
with:
api-key: ${{ secrets.VITRIFIED_API_KEY }}
artifact: |
./dist/release-linux.tar.gz
./dist/release-darwin.tar.gz
./dist/release-windows.zip
schema: slsa.provenance.v1Each artifact is submitted independently; one bundle per artifact is emitted.
OIDC builder identity
When permissions.id-token: write is set, the action requests a GitHub OIDC token and includes
the resulting builder identity in the SLSA provenance predicate. No long-lived signing keys
required.
Releases attaching the bundle
To attach the bundle to a GitHub Release alongside the artifact:
- uses: banchelabs/vitrified-action@v1
id: attest
with:
api-key: ${{ secrets.VITRIFIED_API_KEY }}
artifact: ./dist/release.tar.gz
schema: slsa.provenance.v1
- uses: softprops/action-gh-release@v1
with:
files: |
./dist/release.tar.gz
${{ steps.attest.outputs.bundle-path }}Downstream consumers can verify the release with the vitrified CLI:
gh release download v1.2.3 --pattern "vitrified-bundle-*.json"
vitrified verify ./vitrified-bundle-*.jsonCI gates
To fail a workflow if the bundle doesn't fully verify:
- name: Verify bundle
run: |
npm install -g @vitrified/cli
vitrified verify ${{ steps.attest.outputs.bundle-path }} --output json | jq -e '.isVerified'Inputs
| Input | Description | Default |
|---|---|---|
api-key | Vitrified API key (required). | — |
artifact | Path or glob of artifacts to attest (required). | — |
schema | Metadata schema to declare. | slsa.provenance.v1 |
wait-for-bundle | Wait for the bundle before exiting (true) or fire-and-forget (false). | true |
bundle-output-path | Path where the bundle JSON is written. | ./vitrified-bundle.json |
base-url | API base URL override. | https://api.vitrified.glass |
Outputs
| Output | Description |
|---|---|
submission-id | The submission ID returned by the API. |
bundle-path | Filesystem path to the emitted bundle JSON. |
verdict | verified / partial / failed once the bundle is verified. |
Source
integrations/github-action/
— full action source and tests.
MCP server
@vitrified/mcp — Model Context Protocol server exposing Vitrified as tools any MCP-capable agent can call.
CI build attestation
Attest every CI build artifact automatically — GitHub Actions, CircleCI, GitLab CI, generic shell.
Was this page helpful?