Deterministic ChangeSet digest
CSD-1 derives a change’s identity from Git object IDs, so the same change produces the same digest on any runner.
Open source · AI code provenance
Attest: signed provenance for AI-assisted code changes.
Attest binds what changed, what was declared about AI involvement and what review the forge recorded into one signed in-toto statement, then evaluates a merge policy against it in CI. It answers one deliberately narrow question: which claims and review evidence were present for this exact change, and which trusted workflow signed that record?
v0.1.7 pre-alphaApache-2.0Python 3.12+GitHub Action v1
What Attest is
Attest is an open-source, CI-native provenance toolchain for code changes. It computes a deterministic digest of a pull request’s ChangeSet, collects declared AI-authorship claims and the forge’s review record, signs the result keylessly with the CI job’s Sigstore identity, verifies that identity, and returns an allow, warn or deny decision that can block the merge.
What it is not
- It does not detect who, or what, wrote a line of code. AI use nobody declared is invisible to it.
- It does not judge code quality, and a review record proves a review happened, not that it was understood.
- It is not a compliance certification for any framework.
- It does not replace build provenance such as SLSA. It records authoring and review evidence before the build.
At a glance
Attest in eight facts.
- Type
- Open-source ai code provenance tool
- Licence
- Apache-2.0
- Language
- Python
- Runs on
- Python 3.12 or 3.13, Git 2.40+, GitHub Actions
- Latest release
- v0.1.7, 25 Oct 2026
- Status
- Pre-alpha
The problem
Git records commits, the forge records reviews and AI coding tools emit their own metadata, but nothing binds them into one durable record for a specific change. When a customer, an auditor or your own incident review asks whether AI-assisted code was independently reviewed before it merged, the answer is scattered across dashboards that can be edited after the fact.
How Attest approaches it
Attest turns those signals into a versioned in-toto Statement bound to a deterministic CSD-1 ChangeSet digest, signs it with a keyless Sigstore signature tied to the CI workload identity, and stores the bundle with transparency-log evidence. Verification checks the cryptography and the expected signing identity first; only then does a policy decide whether the change may merge.
How it works
From input to decision.
01 CollectOne exact ChangeSet and its evidence
02 BuildCanonical in-toto Statement
03 SignKeyless Sigstore, CI identity
04 StoreFilesystem, Git ref or OCI
05 VerifySignature, identity and issuer
06 GateAllow, warn or deny
Capabilities
What it does.
AI-authorship claims
Collects self-reported AI involvement from supported repository signals. Raw prompts are never stored.
Forge review records
Reads the pull request’s review state from GitHub, including whether the approver is the change’s own author.
Keyless Sigstore signing
Signs with the GitHub Actions OIDC workload identity, so there is no long-lived signing key to manage or leak.
Mandatory identity checks
verify always requires an identity and an issuer constraint. A valid signature from the wrong workflow still fails.
Policy gate, stable exit codes
allow, warn or deny with stable reason codes and semantic exit codes, ready to become a required status check.
Quickstart
Running in five minutes.
Run from the repository root. It creates exactly three files, .attest/config.yaml, .attest/policy.yaml and .github/workflows/attest.yml, and refuses to overwrite an existing one. The default policy requires one independent human review, so the first run on an unreviewed change is expected to deny it.
Install
uvx --from attest-cli==0.1.5 attest init \
--checkout-ref actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 \
--action-ref Parth2412/attest/action@c42e52d038f5ecdcc498679cb7648e5b0957d489The generated Action step
- uses: Parth2412/attest/action@c42e52d038f5ecdcc498679cb7648e5b0957d489
env:
GITHUB_TOKEN: ${{ github.token }}
with:
mode: run
policy: .attest/policy.yaml
push-attestation: "true"
fail-on-violation: "true"Reference
Exit codes a pipeline can branch on.
Every command returns a semantic exit code; add --json for the closed machine-readable report.
| Exit | Meaning |
|---|---|
0 | Success |
1 | Unexpected internal failure |
2 | Usage or configuration failure |
3 | Policy denied the ChangeSet |
4 | Verification failed |
5 | Required attestation was not found |
6 | Transient network failure; safe to retry |
Walkthrough
The full terminal walkthrough.
A 48-second terminal walkthrough of Attest: inspecting a signed bundle, verifying its Sigstore signature and workflow identity, and the policy denying then allowing the same ChangeSet after an independent review.
Public evidence
Verify it yourself.
Attest’s behaviour is public and re-checkable, not a claim on this page.
Same-repository proof, PR 13
Denied the unreviewed ChangeSet, passed after an independent review, and merged.
Fork proof, PR 14
A fork pull request failed before receiving any signing or write authority.
Release v0.1.7
Checksums, SBOM, SLSA provenance, vulnerability scans and the dogfood bundle for this release.
Hosted cold start for Action v1.0.7: p50 11 s and p95 14 s across 60 samples.
Who it is for
Built for.
Teams adopting AI coding assistants
A durable record that AI-assisted changes were declared and independently reviewed before they merged.
Platform and DevSecOps engineers
A required check that fails closed on bad signatures, unexpected identities and missing reviews.
Software vendors with demanding customers
Review evidence a customer can re-verify without trusting your dashboard or the original runner.
Open-source maintainers
Fork pull requests receive no signing or write authority, so outside contributions stay safe to gate.
Limitations
What it does not do yet.
Stated in the project’s own documentation, so you can decide where it fits.
- A compromised trusted CI workflow can sign malicious content with a genuine workload identity.
- The public Sigstore transparency log can expose repository and workflow metadata.
- Predicate identifiers may change during the 0.x series, and auditor-facing evidence export is not shipped yet.
- The Claude Code and Codex claim hooks are experimental and cover only their documented edit events.
Maintainer
Built and maintained by Parth Kaloliya
Founder & Director, ZettaCore Labs. Attest is developed in the open: issues, pull requests and the full release history are on GitHub.
More open source
The other tools.
AI & Intelligent Systems
We build applied AI systems - retrieval, agents, forecasting and vision - that sit inside real workflows and are evaluated against your data, not a public leaderboard.
Cloud & Infrastructure
Cloud architecture, migration, DevOps and platform engineering - designed for predictable cost, fast recovery and deployments that are boring on purpose.
Software Engineering
Web, mobile, SaaS and enterprise systems built on durable foundations - clear domain models, typed boundaries and tested paths.
FAQ
Questions we get asked.
Attest is an open-source GitHub Action and CLI that records chain of custody for code changes. It binds a deterministic ChangeSet digest, declared AI-authorship claims and the forge’s review record into a Sigstore-signed in-toto statement, verifies the signing workflow, and returns an allow, warn or deny merge decision.
No. GitHub artifact attestations record build provenance for the artifacts a workflow produces. Attest records the authoring and review evidence for a code change before the build, and is designed to complement build provenance rather than replace it.
No. Attest records what was declared. A signature proves a claim was present in the signed statement, not that the claim is true, and AI use nobody declared is invisible to it.
No. It signs keylessly through Sigstore with the GitHub Actions OIDC identity of the workflow run, and verification checks that identity and its issuer before any policy runs.
They receive no signing or write authority and fail before repository-controlled content is read. The generated workflow uses pull_request, and it should never be switched to pull_request_target.
It is public pre-alpha at 0.1.7, with an immutable Action v1.0.7 and a reviewed v1 tag. Predicate identifiers may still change during 0.x, so pin exact versions and commit SHAs.
Want these controls in your delivery pipeline?
We implement provenance gates, LLM regression testing and secrets hygiene for teams shipping AI and fintech systems. Tell us what you run today.