Build releases only in CI and verify them before deploy

How to do it

A release built on a laptop can hold code nobody reviewed. Build it in the hosted CI job, and attach a signed statement of the repository, commit and workflow that made it. The SLSA framework calls this Build Level 2. Tools such as GitHub artifact attestations or Sigstore's cosign create and verify it. The deploy step verifies the statement before the switch and stops when it fails. Publish packages as publish your packages without stored tokens says. The bill of materials and release signature follow Publish what is in each release. Mobile store builds follow the same idea, as Sign release builds only in CI says.

Examples

YAML example

# GitHub Actions: sign provenance for the build. Pin the action to a full commit hash.
permissions:
  contents: read
  id-token: write
  attestations: write
steps:
  - run: npm ci && npm run build && tar -czf shop.tar.gz dist
  - uses: actions/attest@<full-commit-hash> # v4
    with:
      subject-path: shop.tar.gz

Shell example

# Deploy script: refuse anything this repository's CI did not build
gh attestation verify shop.tar.gz -R example/shop || { echo "FAIL: no valid provenance"; exit 1; }

How to check

Build a release on a laptop and try to deploy it. The deploy stops because verification fails, and the same release built in CI deploys.

Sources

• SLSA v1.2 Build track basics
• GitHub artifact attestations

Related rules

• OSS-46 Publish your packages without stored tokens in Open source maintenance
• APS-75 Publish what is in each release in Application security
• MOB-8 Sign release builds only in CI in Mobile apps
• ENG-42 Make release tags and files immutable in Engineering
• ENG-57 Build releases without a shared cache in Engineering
• STK-95 Use cosign to sign release images and their bill of materials in Software choices
• DSK-4 Check every signature in CI before you publish in Desktop apps and extensions
• OSS-19 Tell users how to verify a release in Open source maintenance
• TDD-20 Measure delivery with the DORA metrics over 90 days in Technical due diligence