World map

 

BM

World C2: Container Pipelines

SBOM and provenance in CI

You will learn: to ship an ingredients list and a signed "made here" label.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

A customer asks two questions. What is inside this pack? And did your kitchen really make it?

Watch

An SBOM: Software bill of materials: the ingredients label. It lists every package and version inside. is the ingredients list: every package and version. Provenance says where and how the pack was made. Sort these.

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      Tap the line that signs the "made here" label.

      0 of 1 found

      sbom: true packs the ingredients list with the image. actions/attest signs a provenance: A signed "made here" label: which repo, commit and workflow built this image. statement for that exact image. It goes next to the image in GHCR.

      Try it

      Press Run. Signing fails. Give the job the keys it is missing.

      The line is red. Fix the yellow lines, then run again.

      What happened on GitHub

      Workflow file .github/workflows/publish.yml

      name: Publish
on:
push:
branches: [main]
jobs:
image:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: docker/setup-buildx-action@v4
- uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- id: push
uses: docker/build-push-action@v7
with:
push: true
sbom: true
tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
- uses: actions/attest@v4
with:
subject-name: ghcr.io/${{ github.repository }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true

      Yellow: lines 8–10. You can change these.

      Pick a fix

      The line

      Push to main · main

      Predict

      Why does signing need id-token: write?

      Check

      Anyone can check the label. Build the command.

      Tap the pieces in the right order.

      …

      You did it!

      You can now ship an SBOM and signed provenance with every image.

      Go deeper (optional)

      Attestations alone reach SLSA Build Level 2. Building in a reusable workflow can reach Level 3. Public repos log signatures in Sigstore’s public log. Private repos use GitHub’s own Sigstore. For an SBOM file, actions/attest takes sbom-path.

      Real rep (optional):

      Real mission

      3. gh attestation verify oci://ghcr.io/YOUR-NAME/YOUR-REPO:main -R YOUR-NAME/YOUR-REPO

      0 of 3 steps done · Your ticks are saved.