SLSA Levels

Where it fits in the lifecycle

1. Plan
2. Code
3. Build
4. Test
5. Release
6. Deploy
7. Operate
8. Monitor

• Build Dependency scanning, image scanning, SBOM generation and signing.
• Release Approval controls, artefact promotion and provenance.

Overview

SLSA describes build integrity requirements as levels, from provenance existing at all through to hardened, isolated builds. It is useful as a roadmap and as shared vocabulary with auditors.

Why it matters

Supply chain hardening is open-ended. Levels give teams a concrete order of work and a way to state current maturity.

How it works

1. 01Assess current build practices against the level requirements.
2. 02Adopt provenance generation on a hosted build platform.
3. 03Harden the builder: ephemeral, isolated, parameter-controlled.
4. 04Enforce verification of provenance at consumption points.

Common tools

Implementation examples

permissions:  id-token: write  contents: read  attestations: write jobs:  build:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - id: build        run: make image      - uses: actions/attest-build-provenance@v1        with:          subject-name: ghcr.io/acme/app          subject-digest: ${{ steps.build.outputs.digest }}