StepSecurity Logo
StepSecurity
LoginStart free
actions/attest-build-provenance

actions/attest-build-provenance

Action for generating build provenance attestations for workflow artifacts

GitHubGitHub Repository

1037 stars

Composite

Score updated 4 days ago

Composite Action Details

Pinnable

Yes

GitHub Actions security score

actions/attest-build-provenance

Score

8/10

Pinnable

Yes

License

MIT License

Maintained

5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4

Vulnerabilities

0 existing vulnerabilities detected

Branch protection

branch protection is not maximal on development and all release branches

AI analysis

No Security findings

Manual code review

-

Secure publishing

-

Signed commits

-

Automated security tools

-

Popular

Used by 24032 open-source projects

Security Policy

security policy file detected

Networking Behavior of actions/attest-build-provenance

This GitHub Action often makes outbound network calls to these destinations, as gathered from public workflows using the Harden-Runner GitHub Action. Harden-Runner offers network egress filtering and runtime security for both GitHub-hosted and self-hosted runners.

Popular DestinationUnknown Destination
Network DestinationOwner
fulcio.sigstore.devSigstoreSigstore
rekor.sigstore.devSigstoreSigstore
api.github.comGitHubGitHub
index.docker.ioDockerHubDockerHub
quay.ioUnknown
ghcr.ioGitHubGitHub
production.cloudflare.docker.comDockerHubDockerHub
auth.docker.ioDockerHubDockerHub
registry-1.docker.ioDockerHubDockerHub
github.comGitHubGitHub
fulcio.githubapp.comUnknown
timestamp.githubapp.comUnknown
docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.comDockerHubDockerHub
244531986313.dkr.ecr.eu-central-1.amazonaws.comUnknown
winatp-gw-cus.microsoft.comMicrosoftMicrosoft
us-docker.pkg.devUnknown
release-assets.githubusercontent.comGitHubGitHub
raw.githubusercontent.comGitHubGitHub
tuf-repo-cdn.sigstore.devSigstoreSigstore
392159838427.dkr.ecr.eu-west-1.amazonaws.comUnknown
timestamp.sigstore.devSigstoreSigstore
settings-win.data.microsoft.comMicrosoftMicrosoft
tuf-repo.github.comGitHubGitHub
tmaproduction.blob.core.windows.netUnknown
packages.microsoft.comMicrosoftMicrosoft
init.itunes.apple.comUnknown
updates.cdn-apple.comUnknown
swdist.apple.com.akadns.netUnknown
gdmf.apple.comUnknown
109714237290.dkr.ecr.ap-southeast-1.amazonaws.comUnknown
geo.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
kv501.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
cp501.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
download.windowsupdate.comUnknown
au.download.windowsupdate.comUnknown
sts.googleapis.comGoogleGoogle
mobile.events.data.microsoft.comMicrosoftMicrosoft
gateway-oblivious.apple.comUnknown
0.pool.ntp.orgUnknown
ocsp2.apple.comUnknown
weather-edge.apple.comUnknown
ipcdn.apple.comUnknown
ipcdn-lb.apple.com.akadns.netUnknown
device-config.pcms.apple.comUnknown
configuration.ls.apple.comUnknown
swscan.apple.comUnknown
kv801.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
ocsp.digicert.comUnknown
oneocsp.microsoft.comMicrosoftMicrosoft
cds.apple.comUnknown
help.apple.comUnknown
gsa.apple.comUnknown
gateway.icloud.comUnknown
mesu.apple.comUnknown
fpinit.itunes.apple.comUnknown
cdn-h3.g.aaplimg.comUnknown
configuration.apple.comUnknown
c.apple.newsUnknown
sf-api-token-service.itunes.apple.comUnknown
xp.itunes-apple.com.akadns.netUnknown
e5977.dsce9.akamaiedge.netUnknown
swdist.g.aaplimg.comUnknown
valid.apple.comUnknown
news-edge.apple.comUnknown
mask.icloud.comUnknown
assets-mercury.mzstatic.comUnknown
mask-api.icloud.comUnknown
dns.googleUnknown
_dns.resolver.arpaUnknown
apps.mzstatic.comUnknown
swdist.apple.comUnknown
gdmf-ados.apple.comUnknown
gsp-ssl.ls.apple.comUnknown
fbs.smoot.apple.comUnknown
dap.pat-issuer.cloudflare.comUnknown
configuration.apple.com.akadns.netUnknown
s.mzstatic.comUnknown
xp.apple.comUnknown
pancake.apple.comUnknown
bag.itunes.apple.comUnknown
amp-api.media.apple.comUnknown
swallow.apple.comUnknown
xp-cdn-lb.itunes-apple.com.akadns.netUnknown
bag-cdn-lb.itunes-apple.com.akadns.netUnknown
calendars.icloud.comUnknown
v1.ta2.fe2cr.update.microsoft.comMicrosoftMicrosoft
metrics.icloud.comUnknown
ocsp2.g.aaplimg.comUnknown
configuration-row-lb.apple.com.akadns.netUnknown
apple-relay.fastly-edge.comUnknown
experiments.apple.comUnknown
mesu-cdn.origin-apple.com.akadns.netUnknown
api.apple-cloudkit.fe2.apple-dns.netUnknown
humb.apple.comUnknown
apple-relay.cloudflare.comUnknown
cp801.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
cafe.github.comGitHubGitHub
gspe35-ssl.ls.apple.comUnknown
help.v.aaplimg.comUnknown
gateway.fe2.apple-dns.netUnknown
init-kt.apple.comUnknown
dns.msftncsi.comUnknown
configuration.g.aaplimg.comUnknown
publicassets.cdn-apple.comUnknown
api.apple-cloudkit.comUnknown
247226602506.dkr.ecr.us-east-1.amazonaws.comUnknown
fs.microsoft.comMicrosoftMicrosoft
is4-ssl.mzstatic.comUnknown
images-mercury.mzstatic.comUnknown
is2-ssl.mzstatic.comUnknown
is3-ssl.mzstatic.comUnknown
is5-ssl.mzstatic.comUnknown
go.microsoft.comMicrosoftMicrosoft
definitionupdates.microsoft.comMicrosoftMicrosoft
ipcdn-web.apple.comUnknown
login.live.comUnknown
incoming.telemetry.mozilla.orgUnknown
prod.ingestion-edge.prod.dataops.mozgcp.netUnknown
ocsp.edge.digicert.comUnknown
client.wns.windows.comUnknown
ohttp-relay1.fastly-edge.comUnknown
fe3cr.delivery.mp.microsoft.comMicrosoftMicrosoft
europe-west3-docker.pkg.devUnknown
tas02.sls.update.microsoft.comMicrosoftMicrosoft
www.microsoft.comMicrosoftMicrosoft
fe2cr.update.microsoft.comMicrosoftMicrosoft
is1-ssl.mzstatic.comUnknown
448049792905.dkr.ecr.us-east-1.amazonaws.comUnknown
safebrowsing.googleapis.comGoogleGoogle
www.msftncsi.comUnknown
token.safebrowsing.appleUnknown
proxy.safebrowsing.appleUnknown
prod.ingestion-edge.prod.dataservices.mozgcp.netUnknown
ecs.office.comUnknown
kv601.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
cp601.prod.do.dsp.mp.microsoft.comMicrosoftMicrosoft
wns2-bn3p.wns.windows.comUnknown