{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-29T01:09:39.613311Z",
  "record_id": "VXI-EXT-ICE05-GITHUB-ATTESTATION-SIGNER-WORKFLOW-01-v1",
  "record_kind": "external_reference",
  "title": "GitHub attestation reusable-workflow signer policy",
  "system": "GitHub CLI",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "When a GitHub attestation uses a reusable workflow, which workflow identity must a verifier constrain?",
  "near_questions": [
    "Which workflow signs an attestation from a reusable workflow?",
    "Is the caller repository enough to constrain an attestation signer?",
    "How do I select the expected signer-workflow policy?",
    "Can a reusable workflow change who is trusted to attest?"
  ],
  "supported_claims": [
    {
      "claim": "The GitHub CLI identifies the reusable workflow as the signer for attestations produced through reusable workflows. Verification policy can constrain the signer workflow or repository; the caller repository alone does not fully specify the permitted signer.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Require a deliberate expected signer policy. Do not treat a valid attestation associated with the caller as approval of every reusable workflow signer.",
    "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.",
    "No expanded capabilities or licences for existing INDEX executables."
  ],
  "public_summary": "The GitHub CLI identifies the reusable workflow as the signer for attestations produced through reusable workflows. Verification policy can constrain the signer workflow or repository; the caller repository alone does not fully specify the permitted signer.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitHub CLI: gh attestation verify",
    "source_url": "https://cli.github.com/manual/gh_attestation_verify",
    "checked_on": "2026-10-29",
    "candidate_record_id": "VXI-EXT-ICE05-GITHUB-ATTESTATION-SIGNER-WORKFLOW-01-v1",
    "candidate_record_sha256": "7263c37f7de57698224648a208c06f9d92d8f48dedd2baed44805962641a3c2c",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The GitHub CLI identifies the reusable workflow as the signer for attestations produced through reusable workflows. Verification policy can constrain the signer workflow or repository; the caller repository alone does not fully specify the permitted signer.",
    "required_buyer_context": "Artifact digest; Attestation; Expected signer workflow/repository and revision; Caller context. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-29",
    "claim_to_check": "When a GitHub attestation uses a reusable workflow, which workflow identity must a verifier constrain?",
    "documented_statement": {
      "status": "documented",
      "statement": "The GitHub CLI identifies the reusable workflow as the signer for attestations produced through reusable workflows. Verification policy can constrain the signer workflow or repository; the caller repository alone does not fully specify the permitted signer.",
      "source_ids": [
        "github-attestation-verify"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Review github attestation reusable-workflow signer policy before accepting the buyer claim. The prior record covers general provenance versus safety. This question narrows the expected signer to the called workflow rather than conflating caller and signing workflow. This is a documentation-review judgment, not an observed deployment outcome.",
      "source_ids": [
        "github-attestation-verify"
      ]
    },
    "buyer_evidence_required": [
      "Artifact digest",
      "Attestation",
      "Expected signer workflow/repository and revision",
      "Caller context"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require a deliberate expected signer policy. Do not treat a valid attestation associated with the caller as approval of every reusable workflow signer."
    },
    "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected."
    },
    "evidence_sources": [
      {
        "source_id": "github-attestation-verify",
        "url": "https://cli.github.com/manual/gh_attestation_verify",
        "final_url": "https://cli.github.com/manual/gh_attestation_verify",
        "captured_at_utc": "2026-10-29T00:50:20.614821+00:00",
        "status": 200,
        "content_type": "text/html; charset=utf-8",
        "bytes": 113893,
        "sha256": "9593b240071d03951ef66f047c458e1906cea51e1244d5ae9d978ee0ccf3bc87",
        "title": "GitHub CLI: gh attestation verify",
        "hash_basis": "SHA-256 of captured HTTP response body bytes",
        "checked_on": "2026-10-29",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "gh attestation verify"
        ],
        "version_context": "Rolling official documentation captured 2026-10-29; exact response hash is pinned, not a stable vendor release. Verify the deployed API/version and account feature availability. ",
        "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.",
    "paid_value": {
      "decision_context": "Review github attestation reusable-workflow signer policy before accepting the buyer claim. The prior record covers general provenance versus safety. This question narrows the expected signer to the called workflow rather than conflating caller and signing workflow.",
      "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.",
      "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.",
      "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.",
      "excluded": [
        "Fresh vendor research",
        "Live provider inspection",
        "Runtime enforcement or certification",
        "Expanded executable schemas or licences",
        "Native Coupa, Stripe Issuing, GitLab or Sigstore validation"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.",
      "specific_watch": "gh attestation verify"
    },
    "buyer_relevance": "Review github attestation reusable-workflow signer policy before accepting the buyer claim. The prior record covers general provenance versus safety. This question narrows the expected signer to the called workflow rather than conflating caller and signing workflow.",
    "refusal_conditions": [
      "Require a deliberate expected signer policy. Do not treat a valid attestation associated with the caller as approval of every reusable workflow signer.",
      "Do not infer buyer deployment conformance or successful business outcomes from source documentation."
    ]
  },
  "niche": {
    "niche_id": "ice05-audit",
    "label": "Audit, Provenance & Evidence Accountability",
    "classification_id": "audit",
    "classification_label": "Audit, Provenance & Evidence Accountability",
    "topic_id": "audit",
    "buyer_intent": "Review github attestation reusable-workflow signer policy before accepting the buyer claim. The prior record covers general provenance versus safety. This question narrows the expected signer to the called workflow rather than conflating caller and signing workflow.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#github-attestation-signer-workflow",
  "machine_readable_record": "/varexis-index/records/github-attestation-signer-workflow.json"
}