CONFIGURE GITHUB ARTIFACT ATTESTATION FOR SECURE CLOUD-NATIVE DELIVERY

Summary from the TLDR InfoSec newsletter

Now that Artifact Attestation is generally available, GitHub has published a walkthrough on how to use it. GitHub created the attest-build-provenance action, which can be added to a workflow to add an Attestation to a built artifact. GitHub also released a Kubernetes admission controller, which can be deployed in clusters to verify artifacts' attestations before deployment.