slsa-github-generator provenance job failed in CI

By Kaveh Alemi·Latchkey

The slsa-framework/slsa-github-generator reusable workflow builds signed SLSA provenance. It fails when the caller lacks id-token: write, passes hashes it cannot find, or runs on a ref the generator does not accept.

What this error means

The reusable generator job fails early with a permissions error, "base64-subjects" input problems, or a refusal to run outside the expected event, so no provenance is produced.

Error: Unable to get OIDC token: id-token permission not granted
Error: the base64-subjects input is empty or malformed

Common causes

Missing id-token/contents permissions on the caller

The generator signs keyless and creates a release, so it needs id-token: write and often contents: write. Omitting them stops the job.

Malformed or empty subjects input

The base64-subjects (digest and name of each artifact) must be produced exactly as documented; an empty or wrong value fails the generator.

How to fix it

Call the generator with the right permissions and inputs

1. Grant id-token: write and contents: write to the caller job.
2. Compute base64-subjects from sha256sum of the built artifacts.
3. Pin the generator to a tagged release, not a branch.

permissions:
  id-token: write
  contents: write
  actions: read
jobs:
  provenance:
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: ${{ needs.build.outputs.digests }}

Produce the subjects digest correctly

Emit the base64 of a sha256sum manifest so the generator has valid subjects to attest.

echo "digests=$(sha256sum app-* | base64 -w0)" >> "$GITHUB_OUTPUT"

How to prevent it

• Grant id-token: write and contents: write to the generator caller.
• Pin the reusable workflow to a released tag.
• Generate base64-subjects exactly as the generator documents.

Frequently asked questions

Related guides

References

• GitHub Actions documentation