---
title: "Build releases only in CI and verify them · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/build-in-ci-and-verify
id: ENG-11
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1232
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Build releases only in CI and verify them before deploy

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [CI and supply chain](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: ENG-11
- Level: Recommended
- Chapter: [CI and supply chain](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain.md)
- Rule: Build every release in the CI service from a reviewed commit, with signed provenance. Deploy or publish only a build whose provenance names your repository.
- Check: Build a release on a laptop and try to deploy it. The deploy stops because verification fails, and the same release built in CI deploys.
- How: A release built on a laptop can hold code nobody reviewed. Build it in the hosted CI job, and attach a signed statement of the repository, commit and workflow that made it. The SLSA framework calls this Build Level 2. Tools such as GitHub artifact attestations or Sigstore's cosign create and verify it. The deploy step verifies the statement before the switch and stops when it fails. Publish packages as [publish your packages without stored tokens](https://agentwranglers.se/playbook/open-source/releases/trusted-publishing.md) says. The bill of materials and release signature follow [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md). Mobile store builds follow the same idea, as [Sign release builds only in CI](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/sign-in-ci.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
# GitHub Actions: sign provenance for the build. Pin the action to a full commit hash.
permissions:
  contents: read
  id-token: write
  attestations: write
steps:
  - run: npm ci && npm run build && tar -czf shop.tar.gz dist
  - uses: actions/attest@<full-commit-hash> # v4
    with:
      subject-path: shop.tar.gz
```

### Shell example

```sh
# Deploy script: refuse anything this repository's CI did not build
gh attestation verify shop.tar.gz -R example/shop || { echo "FAIL: no valid provenance"; exit 1; }
```

## Sources

- [SLSA v1.2 Build track basics](https://slsa.dev/spec/v1.2/build-track-basics)
- [GitHub artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations)

## Related rules

- OSS-46 [Publish your packages without stored tokens](https://agentwranglers.se/playbook/open-source/releases/trusted-publishing.md) in Open source maintenance
- APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security
- MOB-8 [Sign release builds only in CI](https://agentwranglers.se/playbook/mobile-apps/signing-and-release/sign-in-ci.md) in Mobile apps
- ENG-42 [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/immutable-releases.md) in Engineering
- ENG-57 [Build releases without a shared cache](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/no-cache-in-release-builds.md) in Engineering
- STK-95 [Use cosign to sign release images and their bill of materials](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/sbom-and-signing.md) in Software choices
- DSK-4 [Check every signature in CI before you publish](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish.md) in Desktop apps and extensions
- OSS-19 [Tell users how to verify a release](https://agentwranglers.se/playbook/open-source/releases/verification-instructions.md) in Open source maintenance
- TDD-20 [Measure delivery with the DORA metrics over 90 days](https://agentwranglers.se/playbook/due-diligence/operations-and-growth/dora-metrics.md) in Technical due diligence

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/build-in-ci-and-verify">Agent Wranglers engineering playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Pin each base image by digest](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/pinned-base-images.md)
- Next: [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/immutable-releases.md)
- [CI and supply chain](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain.md)