SLSA GitHub Generator

Open source

Reusable GitHub Actions that automatically produce signed SLSA provenance attestations for build artifacts.

by SLSA ProjectOfficial site ↗Source code ↗

Pricing: free
Free tier: true
License: open-source
Open source: Yes

Editorial review

SLSA GitHub Generator has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Tags(open-source;cloud-native): SLSA, provenance, GitHub Actions, supply chain security, attestationVerified

Pricing · Licensing

Free plan(true/false): trueVerification pending
License model(proprietary;open-source;source-available;dual-license): open-sourceVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerified
Source repository(HTTPS URL): https://github.com/slsa-framework/slsa-github-generatorVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Language-agnostic SLSA provenance generation for GitHub Actions, Generation and verification of SLSA Build Level 3 provenance for native GitHub projects, Reusable secure build workflows for GitHub Actions, BYOB (Build Your Own Builder) support, Provenance verification with slsa-verifierVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): GitHub projects generating Build Level 3 SLSA provenance via reusable Actions workflows; project no longer actively maintained.Verification pending
Primary use cases(build;monitor;automate): Generating SLSA provenance for GitHub releases, Verifying tamper-proof statements of how software was created, Protecting builds against supply chain attacks and tamperingVerification pending

Lifecycle · Versioning

Current version(1.12.3): 2.1.0Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): deprecatedVerification pending

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): communityVerified

User reviews

Review policy

No published reviews yet.