Sign Artifact

Sign Artifact

Add an Artifact Signing (SscaArtifactSigning) step to an existing Harness pipeline. The step retrieves an artifact from a registry or local workspace, signs it with Cosign, and optionally pushes the .sig signature file back to the registry.

This skill only works with existing pipelines — do not create standalone signing-only pipelines.

Prerequisites: Container images must be built and pushed (or available in registry) before signing. Key-based signing requires Cosign key pair file secrets (/create-secret). Harness docs note that Deploy-stage signing is not yet supported — prefer CI or Security stages.

Guide the user through a step-by-step interactive wizard (same UX as /verify-sign):

• Wizard: references/interactive-wizard-flow.md
• UI ↔ YAML: references/artifact-signing-step.md
• CD note: references/cd-containerized-step-group.md

Interaction model (mandatory)

1. One question per turn — use AskQuestion when available; otherwise numbered options with (Recommended).
2. Opening message — add Artifact Signing after build/push; mention keyless, key-based, Vault, and HAR.
3. Progress breadcrumb — after pipeline fetch: Pipeline · Placement · Source · Details · Signing · Upload · Submit
4. Record answers — running summary; do not re-ask unless the user changes direction.
5. Fetch before configure — harness_get before placement/source questions.
6. Show pipeline structure — highlight build/push and existing SscaArtifactSigning steps.
7. Infer connector from build/push — skip connector question when unambiguous from YAML.
8. Never guess image tags — always ask for image in Phase 7.
9. Confirm before write — summary + harness_update only after user confirms.
10. Stop after update — after successful harness_update, provide a configuration summary and point the user to /run-pipeline to execute. Do not call harness_execute, poll executions, or run harness_diagnose in this skill (same pattern as /configure-repo-scan).
11. Phase 3 Placement is mandatory — always run Phase 2 then Phase 3.
12. Sequential with SBOM/SLSA — if SscaOrchestration or provenance exists, place signing after those steps sequentially (Cosign registry race).
13. Offer all three source tiles — Third-Party, Harness Artifact Registry (HAR), and Harness Local Stage (HAR is supported in YAML even when the UI screenshot shows only two tiles).
14. Existing signing step — if SscaArtifactSigning already exists, ask: update in place, add a second step, or abort. If existing step has uploadSignature.upload: false (or block missing) and user wants .sig in registry, set upload: true.
15. Upload .sig defaults OFF in Harness — UI checkbox Attach signature to Artifact Registry is unchecked by default. For container images, always set uploadSignature.upload: true unless the user explicitly opts out. Confirm this in Phase 9 and in the submit summary.
16. Verify .sig after run — when upload is enabled, after the user runs via /run-pipeline, check step logs for signature push success; see Troubleshooting if registry shows no signature tag.
17. List all connectors before Phase 6 — never show a hand-picked subset. Call harness_list with filters: { type: "<ConnectorType>" } and size: 100 at project, org, and account scope; merge and present every match in AskQuestion. See references/interactive-wizard-flow.md Phase 6.
18. Add CI failureStrategies on update — when inserting signing into a CI stage, ensure the stage has failureStrategies with MarkAsFailure (not Ignore). Missing or Ignore hides signing failures as IgnoreFailed while the pipeline continues.
19. Warn when no build/push step — if the pipeline has no image build/push step, warn that signing will target a pre-existing registry image; confirm the tag exists and was pushed before signing.
20. Surgical YAML only — harness_update must start from the exact yamlPipeline returned by harness_get in this session. Insert or update only the SscaArtifactSigning step (and CI failureStrategies if required). Never add, remove, or reorder other steps. Never add HarnessSAST, HarnessSCA, STO scanners, or /configure-repo-scan steps — use those skills only when the user explicitly asks for code/container scanning.

Full phase prompts: references/interactive-wizard-flow.md.

Instructions

Wizard phases

After Phase 10 confirm → generate YAML, insert step, harness_update, then provide summary (do not run the pipeline).

Supported stage types

After the wizard — backend steps

Extract connectors from pipeline YAML

From BuildAndPushDockerRegistry, BuildAndPushECR, BuildAndPushGCR, BuildAndPushGAR, BuildAndPushACR, Kaniko/Run push steps, SscaOrchestration, SscaArtifactSigning, or provenance steps — reuse connectorRef / connector. Signing source uses connector (not connectorRef).

Generate Artifact Signing step YAML

Use only wizard answers. Docker Third-Party uses source.spec.image (not repo).

Docker Registry — key-based signing (Harness docs reference):

- step:
    identifier: artifactsigning
    name: Artifact Signing
    type: SscaArtifactSigning
    spec:
      source:
        type: docker
        spec:
          connector: lavakush07
          image: lavakush07/easy-buggy-app:v5
      signing:
        type: cosign
        spec:
          private_key: account.cosign_private_key
          password: account.cosign_password
      uploadSignature:
        upload: true
    timeout: 15m

Keyless signing (Harness OIDC) — include upload when pushing .sig:

      signing:
        type: keyless
        spec:
          oidcProvider: harness
      uploadSignature:
        upload: true

Non-Harness keyless OIDC (requires account Connector for Keyless Signing):

      signing:
        type: keyless
        spec:
          oidcProvider: non-harness
      uploadSignature:
        upload: true

Harness Artifact Registry (HAR):

      source:
        type: har
        spec:
          registry: <har_registry_identifier>
          image: my-image:v5

Harness Local Stage (non-container):

      source:
        type: local
        spec:
          workspace: <path_in_workspace>
          artifact_name: my-artifact.jar
          version: "1.0.0"

No registry upload: omit uploadSignature or set upload: false. Harness still stores signature metadata internally — but external tools and registry-side verify need upload: true.

Amazon ECR / GCR / GAR / ACR: see references/artifact-signing-step.md — always include uploadSignature.upload: true when user expects .sig in the registry.

Insert step into pipeline YAML

Critical: Parse yamlPipeline from harness_get and treat it as the only source of truth. Do not rebuild the pipeline from examples, templates, or assumptions (e.g. cloneCodebase: true does not imply a Harness Code Scan step).

• Insert at Phase 3 placement — after build/push (or after SBOM/SLSA when present).
• Do not modify unrelated steps, variables, or failure strategies — except add CI failureStrategies if the stage has none or uses Ignore (use MarkAsFailure).
• Before harness_update, diff mentally: step count must increase by at most one (or zero if updating an existing SscaArtifactSigning). If any new step types appear (e.g. HarnessSAST), stop and fix the YAML — do not save.
• Step identifier: artifactsigning (use artifactsigning_2, etc. if duplicate). CD Deploy placement is unsupported — do not use _cd suffix for signing steps.

CI stage must include failureStrategies (API may accept saves without it, but runs show IgnoreFailed when signing fails):

failureStrategies:
  - onFailure:
      errors: [AllErrors]
      action:
        type: MarkAsFailure

Update pipeline via MCP

harness_update
  resource_type: pipeline
  resource_id: <pipeline_identifier>
  org_id: <organization>
  project_id: <project>
  body: { yamlPipeline: "<updated pipeline YAML>" }

On validation errors, read the API message. Common fixes: image vs repo, signing vs attestation, private_key / password secret refs for key-based cosign.

Provide summary

Report the results to the user (same pattern as /configure-repo-scan — do not execute the pipeline):

## Artifact Signing Configured

**Pipeline:** <pipeline_name>
**Step:** Artifact Signing (SscaArtifactSigning)
**Location:** Stage "<stage_name>", <position>
**Source:** docker — <connector> — <image>
**Signing:** Keyless (Harness OIDC) — or as configured
**Upload .sig:** Yes / No

**Pipeline URL:** https://app.harness.io/ng/account/<account_id>/module/ci/orgs/<org_id>/projects/<project_id>/pipelines/<pipeline_id>/pipeline-studio/

**Note:** Review the Artifact Signing step in Pipeline Studio to adjust Advanced settings.

**Signature:** After a successful run, view on the Supply Chain tab and Chain of Custody.

### Next Steps
1. Run the pipeline via `/run-pipeline` to verify the Artifact Signing step executes successfully
2. If the run fails, diagnose with `/debug-pipeline`
3. If **no `.sig` in registry**, confirm `uploadSignature.upload: true` — see Troubleshooting
4. Add verification with `/verify-sign`
5. Add SBOM/SLSA **before** signing if not present (`/manage-supply-chain` or `SscaOrchestration` / `provenance`)
6. Automate with `/create-trigger`

Examples

After Docker build/push — key-based sign + upload .sig

/sign-artifact
Add artifact signing after docker push — lavakush07/easy-buggy-app:v5, key-based with account cosign secrets, upload signature

Keyless on Harness Cloud

/sign-artifact
Use defaults — keyless Harness OIDC after Build_and_Push, attach signature to registry

Harness Artifact Registry

/sign-artifact
Sign image my-service:v2 from Harness Artifact Registry registry-id prod-har — keyless

Placement must be explicit

/sign-artifact
add signing to the pipeline

Agent must still run Phase 2 + Phase 3 — do not assume stage or skip placement.