Ecosystem Hub
The attested-delivery org is a set of composable, independently useful repos that share one promise: the thing you verified is the thing that runs. Each repo is a separate concern — template, reusable workflow catalog, plugin marketplace, or docs — and they fit together through the same attestation model.
For the model itself, start with the Overview and the Concepts series. This page is the map, not the explanation.
Repositories
Section titled “Repositories”Each entry below links to that repo’s own documentation. The repos own their specifics; we link, never duplicate.
Production-grade Rust crate template: multi-platform builds (5 targets), just-driven local CI parity, SLSA Build Level 3 provenance, CycloneDX SBOM, and crates.io trusted publishing. The v0.1.0 release is publicly attested and is the artifact used in the introductory tutorial.
Copier template for attested OpenTofu/Terraform modules and per-cloud examples. Wires Trivy and Checkov quality gates so IaC changes carry the same signed, digest-bound verdicts as application code.
Language-agnostic Copier template for the attested release pipeline. Instantiates a thin caller repo that wires the central reusable workflows from .github, produces SLSA provenance and a CycloneDX SBOM on every release, and includes a fail-closed admission-verify job. The v0.1.0 release is publicly attested.
Attested Claude Code plugin marketplace. Plugins are admitted through a catalog gate: each accepted plugin carries a signed attestation of the review verdict so admission is fail-closed and the decision is independently verifiable.
Learn the ecosystem
Section titled “Learn the ecosystem”The in-site documentation is organized by the Diátaxis framework. Pick the quadrant that matches what you need right now.
Tutorial — Learning by doing
Section titled “Tutorial — Learning by doing”| Page | What you will do |
|---|---|
| Verify Your First Attested Release | Download a published artifact and verify its SLSA provenance and CycloneDX SBOM from a clean workstation |
How-to guides — Task-oriented
Section titled “How-to guides — Task-oriented”| Page | Task |
|---|---|
| Onboard a repo | Wire a repo to the central quality-gate reusables and attestation seam |
| Verify a release | Verify a release artifact’s provenance, SBOM, and gate attestations from the command line |
| Promote a build | Copy a release artifact by digest between environments with attestations intact |
Reference — Authoritative specification
Section titled “Reference — Authoritative specification”| Page | What it covers |
|---|---|
| Quality gate workflows | SAST, SCA, container, IaC, posture, and DAST reusable workflow contracts |
| Signing and verification workflows | reusable-attest-scan, sign-and-attest, verify-attestation, and reusable-verify-gates contracts |
| CI and pinning workflows | pin-check, actionlint, and catalog-check contracts |
| Catalog updater | How the .github reusable catalog is versioned and how callers update their SHA pins |
Explanation — Understanding
Section titled “Explanation — Understanding”| Section | What it covers |
|---|---|
| Concepts | The foundational ideas: digest identity, attestation referrers, SLSA L3, fail-closed admission, and supply-chain hazards |
| Specifications | Formal contracts for quality gates, interface boundaries, and the promotion-attestation pipeline |
| ADRs | Recorded architectural decisions — why we made the choices we made and what we ruled out |
Discussion
Comments are powered by GitHub Discussions. Sign in with GitHub to ask a question or share how this applies in your org.