SLSA Supply Chain Attestation Gate Blueprint for Kestra

id: slsa-supply-chain-attestation-gate
namespace: company.team
description: |
  Admission gate for container images: generate a CycloneDX SBOM, attach a cosign
  attestation, cryptographically verify signature and attestation against your
  public key, and promote the image to the production reference only when both
  verify - otherwise the release is blocked with a GitHub issue.

inputs:
  - id: image
    type: STRING
    displayName: Image reference to admit
    description: Fully qualified image produced by CI. The webhook payload may override it.
    defaults: ghcr.io/my-org/my-app:1.4.2

  - id: promote_to
    type: STRING
    displayName: Production image reference
    description: Reference the image is cosign-copied to when the gate passes -
      signatures travel with it.
    defaults: ghcr.io/my-org/my-app:production

  - id: repository
    type: STRING
    displayName: GitHub repository for blocked releases
    defaults: your-org/your-repo

tasks:
  - id: prepare_evidence
    type: io.kestra.plugin.core.flow.WorkingDirectory
    description: One shared directory so the SBOM, cosign JSON outputs, and verdict
      files pass between tasks.
    tasks:
      - id: sbom
        type: io.kestra.plugin.trivy.cli.TrivyCLI
        description: Generate a CycloneDX SBOM for the image as the attestation predicate.
        commands:
          - trivy image --format cyclonedx --output sbom.json "{{
            trigger.body.image ?? inputs.image }}"

      - id: sign_attest
        type: io.kestra.plugin.scripts.shell.Commands
        description: Sign the image and attach the SBOM as a CycloneDX attestation
          (cosign container runner).
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: bitnami/cosign:latest
        env:
          COSIGN_KEY: "{{ secret('COSIGN_PRIVATE_KEY') }}"
          COSIGN_PASSWORD: "{{ secret('COSIGN_PASSWORD') }}"
        commands:
          - cosign sign --yes --key env://COSIGN_KEY "{{ trigger.body.image ??
            inputs.image }}"
          - cosign attest --yes --key env://COSIGN_KEY --type cyclonedx
            --predicate sbom.json "{{ trigger.body.image ?? inputs.image }}"

      - id: verify
        type: io.kestra.plugin.scripts.shell.Commands
        description: Verify signature and attestation against the public key - failures
          write marker files instead of aborting, so the gate gets to decide.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: bitnami/cosign:latest
        env:
          COSIGN_PUBLIC_KEY: "{{ secret('COSIGN_PUBLIC_KEY') }}"
        commands:
          - cosign verify --key env://COSIGN_PUBLIC_KEY --output json "{{
            trigger.body.image ?? inputs.image }}" > verify.json || echo
            signature_verification_failed > signature.failed
          - cosign verify-attestation --key env://COSIGN_PUBLIC_KEY --type
            cyclonedx "{{ trigger.body.image ?? inputs.image }}" > attest.json
            || echo attestation_verification_failed > attestation.failed

      - id: verdict
        type: io.kestra.plugin.scripts.python.Script
        description: Turn the marker and JSON files into an explicit gate verdict the If
          task can branch on.
        script: |
          import os
          from kestra import Kestra

          def file_ok(path):
              return os.path.exists(path) and os.path.getsize(path) > 0

          signature_ok = file_ok("verify.json") and not os.path.exists("signature.failed")
          attestation_ok = file_ok("attest.json") and not os.path.exists("attestation.failed")
          gate_pass = signature_ok and attestation_ok

          Kestra.outputs({
              "signature_ok": signature_ok,
              "attestation_ok": attestation_ok,
              "gate_pass": gate_pass,
          })

  - id: integrity_gate
    type: io.kestra.plugin.core.flow.If
    description: Promote only images whose signature and SBOM attestation both
      verify; block everything else with an issue.
    condition: "{{ outputs.verdict.vars.gate_pass }}"
    then:
      - id: promote
        type: io.kestra.plugin.scripts.shell.Commands
        description: Copy the admitted image to the production reference - cosign copy
          carries signatures and attestations along.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: bitnami/cosign:latest
        commands:
          - cosign copy --force "{{ trigger.body.image ?? inputs.image }}" "{{
            inputs.promote_to }}"

      - id: announce_promotion
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        messageText: |
          :white_check_mark: Image admitted by the SLSA gate: *{{ trigger.body.image ?? inputs.image }}* - signature {{ outputs.verdict.vars.signature_ok }}, SBOM attestation {{ outputs.verdict.vars.attestation_ok }}. Copied to {{ inputs.promote_to }} (execution {{ execution.id }}).

    else:
      - id: open_block_issue
        type: io.kestra.plugin.github.issues.Create
        description: Blocked release becomes an assignable ticket with the failing half
          of the verdict.
        jwtToken: "{{ secret('GITHUB_TOKEN') }}"
        repository: "{{ inputs.repository }}"
        title: "Release blocked by attestation gate: {{ trigger.body.image ??
          inputs.image }} (signature={{ outputs.verdict.vars.signature_ok }},
          attestation={{ outputs.verdict.vars.attestation_ok }})"
        labels:
          - supply-chain
          - release-blocked
        body: |
          ## SLSA attestation gate - release blocked

          | Check | Result |
          |---|---|
          | Signature verification | {{ outputs.verdict.vars.signature_ok }} |
          | SBOM (CycloneDX) attestation | {{ outputs.verdict.vars.attestation_ok }} |
          | Image | {{ trigger.body.image ?? inputs.image }} |
          | Production reference | {{ inputs.promote_to }} |

          Execution `{{ execution.id }}` refused to promote this image. Re-sign and re-attest (or fix the public key material) before releasing.

      - id: alert_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        messageText: |
          :no_entry: SLSA gate blocked *{{ trigger.body.image ?? inputs.image }}* - signature_ok={{ outputs.verdict.vars.signature_ok }}, attestation_ok={{ outputs.verdict.vars.attestation_ok }}. Not promoted to {{ inputs.promote_to }}; issue filed.

      - id: fail_gate
        type: io.kestra.plugin.core.execution.Fail
        description: Fail so any deploy pipeline waiting on this admission gate stops
          before pulling the image.
        errorMessage: "Attestation gate blocked {{ trigger.body.image ?? inputs.image
          }}: signature={{ outputs.verdict.vars.signature_ok }}, attestation={{
          outputs.verdict.vars.attestation_ok }} - not promoted."

outputs:
  - id: image
    type: STRING
    value: "{{ trigger.body.image ?? inputs.image }}"

  - id: promoted_to
    type: STRING
    value: "{{ inputs.promote_to }}"

  - id: gate_pass
    type: BOOLEAN
    value: "{{ outputs.verdict.vars.gate_pass }}"

errors:
  - id: alert_on_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    messageText: ":rotating_light: SLSA gate {{ flow.id }} FAILED (execution {{
      execution.id }}): {{ error.message }}"

triggers:
  - id: image_push
    type: io.kestra.plugin.core.trigger.Webhook
    description: CI or the registry's EventBridge relay POSTs here after a push -
      body field `image` overrides the input. Replace the key with your own
      value.
    key: replace-with-a-random-key

Diagram unavailable

We could not build the topology for this blueprint. The flow itself is valid, use the YAML on the left to run it.

Signing an image proves who built it; verifying the signature before production pulls it proves someone actually checked. Most pipelines do the first half and skip the second - the registry accepts whatever CI pushes, and the first time anyone verifies a signature is during an incident. This blueprint is the missing admission control: every pushed image gets an SBOM, an attached attestation, a cryptographic verification against your public key, and only then a promotion to the production reference. Anything that fails either half stops the release with a ticket instead of a red build nobody reads.

How it works

image_push (io.kestra.plugin.core.trigger.Webhook) receives the pushed image reference from CI or a registry event relay; trigger.body.image overrides the image input.
prepare_evidence (io.kestra.plugin.core.flow.WorkingDirectory) gives the evidence tasks one shared directory. Inside it, sbom (io.kestra.plugin.trivy.cli.TrivyCLI) generates a CycloneDX SBOM (sbom.json) - the predicate the attestation will cover.
sign_attest (io.kestra.plugin.scripts.shell.Commands on the bitnami/cosign Docker runner, key material from env) signs the image and attaches the SBOM as a cyclonedx attestation.
verify runs cosign verify and cosign verify-attestation against COSIGN_PUBLIC_KEY - deliberately writing marker files on failure instead of aborting, so the gate decides the outcome, not the shell exit code.
verdict (io.kestra.plugin.scripts.python.Script) reads the JSON outputs and marker files into signature_ok, attestation_ok, and gate_pass.
integrity_gate (io.kestra.plugin.core.flow.If): on pass, promote runs cosign copy so the production reference carries signatures and attestations with it, and Slack announces the admission; on failure, open_block_issue (io.kestra.plugin.github.issues.Create) files a labeled release-blocked ticket with both check results, Slack alerts, and core.execution.Fail stops any deploy pipeline waiting on this gate.
The flow-level errors handler alerts Slack when the gate itself breaks (registry outage, key material missing), so a broken gate reads as blocked, never as approved.

What you get

A real admission decision: production only ever pulls images whose signature and SBOM attestation verify against your key.
SBOM generation built in - the CycloneDX document is the attestation predicate, not a report someone remembers to file.
Promotion via cosign copy, so provenance travels to the production reference.
Blocked releases as assignable GitHub issues carrying the exact failing check.
image, promoted_to, and gate_pass outputs for deploy pipelines to wait on.

Who it's for

Platform teams enforcing SLSA-style provenance on everything that reaches production registries.
Security engineers who need attestation evidence, not just a green checkmark in CI.
Regulated environments where "the image was signed and verified" must be demonstrable per release.

Why orchestrate this with Kestra

Verification stapled into CI scripts fails open: the job is skipped, the key is missing, and nothing stops the deploy. Kestra makes the gate a first-class execution with a failure handler that alerts, outputs that downstream pipelines can wait on, webhook entry from any registry event, and an audit trail where every admission or block is a recorded decision with its numbers.

Prerequisites

A worker with Trivy installed (or wrap it in a container runner) and Docker access for the cosign steps.
An image already pushed to a registry the worker can reach.
cosign key pair: private key for signing, public key for verification.

Secrets

COSIGN_PRIVATE_KEY: PEM-encoded cosign private key (used via env://COSIGN_KEY).
COSIGN_PASSWORD: password protecting the private key.
COSIGN_PUBLIC_KEY: PEM-encoded cosign public key for verification.
SLACK_WEBHOOK_URL: Slack incoming webhook for admission and failure messages.
GITHUB_TOKEN: token with issue-write access to the repository input.

Quick start

Add the five secrets above and replace the webhook key with a strong random value.
Set image to a pushed reference and promote_to to your production tag.
Run once - watch sbom, sign_attest, verify, and the verdict numbers.
Delete the public key secret (or sign with a different key) and run again - expect marker files, gate_pass=false, the GitHub issue, and the failed execution.
Wire the image_push webhook to CI and gate deploys on this flow finishing green.

How to extend

Add CVE policy to the admission: run trivy image --exit-code 1 --severity HIGH,CRITICAL before sign_attest so vulnerability and provenance share one gate.
Verify signatures from multiple keys (vendor + internal) by adding a second cosign verify command and requiring both in verdict.
Record every admission: append image and gate_pass to a registry table with a jdbc task for audit dashboards.
Keyless mode: swap --key env://... for --certificate-identity / --certificate-oidc-issuer to verify Fulcio-issued signatures.

SLSA Supply-Chain Attestation Admission Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

SLSA Supply-Chain Attestation Admission Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Fan Out S3 Object Events to Lambda and SNS

Renew TLS certificates through ACME, verify them, deploy them and roll back on failure

AI Incident Post-Mortem and Root Cause Generator

Automatically Review GitHub Pull Requests with OpenAI GPT-4o and Post Comments

Weekly Azure Blob Backup Archive with Gated Expiry Cleanup

AWS Cost Explorer Spend Anomaly Guard

New to Kestra?