SLSA framework overview

Pipefort’s SLSA v1.2 Build- and Source-track coverage, control by control.

Pipefort scores every scanned repository against the SLSA v1.2 specification. Two tracks are covered:

• Build track — how artifacts are produced (Levels 1–3). Workflow-YAML checks live here.
• Source track — how source code is managed (Levels 1–4). Repository- settings checks (branch protection, etc.) live here.

The dedicated SLSA dashboard renders both tracks side-by-side with per-control pass/fail heatmaps and a “lowest-scoring repositories” list.

Build track

Run pipefort -r slsa-build-l2 (or any level) to filter the CLI to just these rules. The web app’s /slsa page exposes the same filter on the API call.

Rule	Level	Severity	Auto-fix
Command piped to shell	L1	HIGH	✗
Self-hosted runner	L2	LOW	✗
Missing permissions:	L2	MEDIUM	✓
Permissions overly broad	L2	HIGH	✗
Build provenance missing	L2	HIGH	✗
Provenance signing scope missing	L2	MEDIUM	✗
Verify step missing	L2	INFO	✗
Pinned actions	L3	MEDIUM	✓
pull_request_target checkout	L3	HIGH	✓
Provenance not isolated	L3	MEDIUM	✗
Cache poisoning in PR	L3	HIGH	✗

Level definitions

Level	Summary
L1	Build process is consistent; provenance distributed to consumers.
L2	Hosted build platform; provenance is signed and verifiable.
L3	Hardened builds: signing key isolated from user-defined build steps. On GitHub this requires the slsa-framework/slsa-github-generator reusable workflow — in-job signing only meets L2.

Source track

These rules need the GitHub App’s extended permissions so Pipefort can read repository settings.

Rule	Level	Severity
No force pushes	L2	HIGH
No deletion	L2	HIGH
Signed commits	L2	LOW
Branch protection exists	L3	HIGH
Status checks required	L3	MEDIUM
Admins cannot bypass	L3	HIGH
Reviews required	L4	HIGH
≥ 2 reviewers	L4	MEDIUM
Stale reviews dismissed	L4	MEDIUM
CODEOWNERS review	L4	LOW
Actions cannot approve PRs	L4	HIGH

Level definitions

Level	Summary
L1	Version controlled (any GitHub repo trivially satisfies this).
L2	History preserved: no force-push, no branch deletion.
L3	Continuous technical controls — branch protection, required status checks, no admin bypass.
L4	Two-party review enforced (≥ 2 reviewers, dismiss stale, CODEOWNERS, no bot approvals).

How the SLSA level is computed per repo

A repo passes level L when no enabled rule tagged for that level (or any lower level) fired in its latest scan. The dashboard’s Level Ladder widget shows the score per track and the count of passing controls at each level.

Repositories without a recent scan show as L0 (Build) and L1 (Source) — the latter because a GitHub-hosted repo trivially satisfies Source L1 (Version Controlled).