Commands

gh attestation verify oci://<image> -R

gh attestation verify oci://<image> -R <owner/repo>

Risk: Safe

What it does

Checks the signed provenance of an image: which repo and workflow built it.

When to use it

Before you run an image you didn't build yourself.

Example

$ gh attestation verify oci://ghcr.io/you/kedai-kancil:1.2.0 -R you/kedai-kancil

Learn it in: SBOM and provenance in CI · Official docs