attest-vm-image

attest-vm-image is a GitHub Action that inspects a finished QCOW2 VM disk image and produces auditable evidence about what is inside it, then optionally signs that evidence.

Use it immediately after building an image so the exact bytes produced by the builder are the bytes inspected and attested. The action never modifies the input image.

Start here

• Follow Getting started to add unsigned validation to a workflow and inspect the resulting evidence.
• Use Publish signed attestations when you are ready to sign and publish evidence with GitHub artifact attestations.
• Read How it works for the inspection and evidence model.

Find an answer

• Isolate signing credentials
• Verify evidence and attestations
• Control validation policy
• Troubleshoot a failed run
• Action reference
• Validation predicate