Overview
Keyless software-supply-chain attestation for private CI pipelines.
Attest
@absolutejs/attestv0.1.3betaPlatform & InfraKeyless Sigstore attestation policy, provenance, signing, and verification for private CI pipelines.
#Installation
BASH
bun add @absolutejs/attest#Capabilities
Overview
Keyless software-supply-chain attestation for private CI pipelines.
@absolutejs/attest binds an immutable container digest or release file to an exact GitHub Actions repository, workflow, ref, and commit. It creates SLSA v1 provenance predicates, builds fail-closed Cosign command plans, stores image provenance and SPDX SBOM attestations beside the image in its OCI registry, and creates portable Sigstore bundles for ordinary release files.
The package does not implement cryptography, operate a certificate authority, or replace Sigstore. The official Cosign client performs signing and verification against Fulcio, Rekor, and the Sigstore trust root. This package owns the reusable policy that tells Cosign exactly which workflow identity and artifact digest are acceptable.
Why this is not part of @absolutejs/deploy
Attestation happens before deployment and remains useful without a deployer. Build systems produce evidence, registries retain it, admission controls verify it, and offline release reviewers inspect it. @absolutejs/deploy may require valid evidence before activation, but it should not own the trust model.
GitHub Actions identity
Every verification command requires:
the exact Fulcio OIDC issuer;
the exact GitHub repository;
Show 5 more
the exact workflow file;
the exact branch or tag ref;
the exact source commit;
a digest-pinned OCI image reference.
Tags such as latest, abbreviated commits, unqualified workflow names, and non-GitHub invocation URLs are rejected.
CLI
The package exports absolute-attest for CI jobs:
The CLI reads GitHub's standard GITHUB_REPOSITORY, GITHUB_WORKFLOW_REF, GITHUB_REF, GITHUB_SHA, GITHUB_SERVER_URL, and GITHUB_RUN_ID variables. None are credentials. Cosign obtains the job's short-lived OIDC identity directly from GitHub Actions.
Security properties
No long-lived signing key.
No custom cryptography.
Immediate verification after every signing or attestation operation.
Show 7 more
Exact certificate identity and GitHub workflow claims.
SHA-256 digest-pinned images only.
SLSA v1 provenance bound to the source commit and workflow invocation.
SPDX JSON SBOM attestations stored with the OCI image.
Portable Sigstore bundles for non-container release files.
Sequential execution that stops at the first violated boundary.
MIT licensed.
Outcomes
What you can build
Why this is not part of @absolutejs/deploy
Attestation happens before deployment and remains useful without a deployer. Build systems produce evidence, registries retain it, admission controls verify it, and offline release reviewers inspect it. @absolutejs/deploy may require valid evidence before activation, but it should not own the trust model.
GitHub Actions identity
Every verification command requires:
Hardening checklist
Production guidance
Why this is not part of @absolutejs/deployAttestation happens before deployment and remains useful without a deployer. Build systems produce evidence, registries retain it, admission controls verify it, and offline release reviewers inspect it. @absolutejs/deploy may require valid evidence before activation, but it should not own the trust model.
Security propertiesNo long-lived signing key.
Follow in order
Troubleshooting path
1
Why this is not part of @absolutejs/deploy
Attestation happens before deployment and remains useful without a deployer. Build systems produce evidence, registries retain it, admission controls verify it, and offline release reviewers inspect it. @absolutejs/deploy may require valid evidence before activation, but it should not own the trust model.
#GitHub Actions identity
Partial snippetWorking example for GitHub Actions identity.
TS
import {
createImagePublicationCommands,
githubWorkflowIdentityFromEnvironment,
} from "@absolutejs/attest";
const identity = githubWorkflowIdentityFromEnvironment(process.env);
const commands = createImagePublicationCommands({
identity,
imageReference:
"ghcr.io/acme/api@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
provenancePath: "evidence/provenance.json",
sbomPath: "evidence/sbom.spdx.json",
});#CLI
Partial snippetThe package exports absolute-attest for CI jobs:
SH
absolute-attest provenance evidence/provenance.json
absolute-attest publish-image \
"$IMAGE_NAME@$IMAGE_DIGEST" \
evidence/provenance.json \
evidence/sbom.spdx.json \
evidence/attestations.json
absolute-attest sign-blobs \
release/release.json \
release/images.env \
release/sha256sums.txt
absolute-attest verify-blobs \
release/release.json \
release/images.env \
release/sha256sums.txt
absolute-attest verify-image \
"$IMAGE_NAME@$IMAGE_DIGEST"#Public entry points
Supported entry points declared by this project’s package manifest. Internal dist paths are not part of the package contract.
Public package entry point declared in package.json.
@absolutejs/attest@absolutejs/attest/manifest@absolutejs/attest/manifest.json
#Package commands
Scripts declared by this project’s package manifest.
bun run buildrm -rf dist && bun build src/index.ts src/cli.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run typecheck && bun run lint && bun run verify-package && bun run build && bun run verify-package --artifacts && bun run test && bun run verify-pack
bun run formatprettier --write "./**/*.{ts,json,md,mjs}"
bun run linteslint . --max-warnings 0
bun run testbun test
bun run typechecktsc --noEmit
#API reference
Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.
Continue toward an outcome
These playbooks show where this package fits, how to verify the combined system, and what changes before production.