Sign Agent Cards in CI/CD

You can sign Agent Cards in CI/CD environments that provide OIDC tokens without interactive OAuth flow.

Before you begin

  • You have installed rh-sigstore-a2a.
  • You have prepared an Agent Card JSON file.
  • Your CI/CD environment provides OIDC tokens (GitHub Actions, GitLab CI).

Procedure

Sign the Agent Card using ambient credentials: 
$ rh-sigstore-a2a sign <agent_card_file> \
  --output <output_path> \
  --use_ambient_credentials

where:

<agent_card_file>
Your Agent Card JSON file
<output_path>

Path for the signed output file

The tool automatically detects the CI provider and obtains the appropriate OIDC token.