Sign Agent Cards with SLSA provenance

You can embed build provenance metadata in the signed Agent Card to capture source repository and build information.

Before you begin

  • You have installed rh-sigstore-a2a.
  • You have prepared an Agent Card JSON file.

Procedure

Sign the Agent Card with provenance: 
$ rh-sigstore-a2a sign <agent_card_file> \
  --output <output_path> \
  --use_ambient_credentials \
  --provenance \
  --repository <org>/<repo> \
  --commit_sha "$<COMMIT_SHA>" \
  --workflow_ref "<workflow_path>@<ref>"

where:

<agent_card_file>
Your Agent Card JSON file
<output_path>
Path for the signed output file
<org>/<repo>
GitHub organization and repository name
<COMMIT_SHA>
Environment variable containing the commit SHA
<workflow_path>@<ref>

Workflow file path and git reference

In GitHub Actions, the --repository and --commit_sha values are automatically detected from environment variables if not provided explicitly. The provenance attestation captures the source repository, commit SHA, workflow reference, builder identity, run ID, and timestamps.