Verify Sign

Verify Sign

Add an Artifact Verification (SscaArtifactVerification) step to an existing Harness pipeline. The step verifies Cosign signatures on artifacts — typically immediately after SscaArtifactSigning.

This skill only works with existing pipelines — do not create standalone verification-only pipelines.

Prerequisites: Artifact must already be signed (typically via /sign-artifact / SscaArtifactSigning). Key-based verify requires the Cosign public key file secret matching the signing private key (/create-secret). If signing did not upload .sig to the registry, Harness pulls the signature from its database during verification.

Supported stages: CI, Security, and CD (Deployment in containerized step group before deploy).

Guide the user through a step-by-step interactive wizard (same UX as /sign-artifact):

• Wizard: references/interactive-wizard-flow.md
• UI ↔ YAML: references/artifact-verification-step.md
• CD containerized step groups: references/cd-containerized-step-group.md

Interaction model (mandatory)

1. One question per turn — use AskQuestion when available; otherwise numbered options with (Recommended).
2. Opening message — add Artifact Verification; mention signing prerequisite + HAR support.
3. Progress breadcrumb — after pipeline fetch: Pipeline · Placement · Source · Details · Verify · Submit
4. Record answers — running summary; do not re-ask unless the user changes direction.
5. Fetch before configure — harness_get before placement/source questions.
6. Show pipeline structure — highlight SscaArtifactSigning and connectors.
7. Infer source from signing — when one SscaArtifactSigning step exists, reuse its source. If multiple exist, ask which step to mirror.
8. Never guess image tags — default from signing step; ask if ambiguous.
9. Confirm before write — summary + harness_update only after user confirms.
10. Stop after update — after successful harness_update, provide a configuration summary and point the user to /run-pipeline to execute. Do not call harness_execute, poll executions, or run harness_diagnose in this skill (same pattern as /configure-repo-scan).
11. CD on CI-only pipeline — do not reject CD verify; run Phase 3b to add Deploy stage + containerized group.
12. Verify method must match signing — keyless ↔ keyless, keybased/cosign ↔ public key from same key pair.
13. Offer all three source tiles — Third-Party, HAR, and Harness Local Stage.
14. List all connectors in Phase 6 — same rules as /sign-artifact: harness_list with filters.type, all scopes, size: 100, paginate; never hand-pick a subset. See wizard Phase 6.
15. List all infrastructure in Phase 3b — harness_list per environment with filters.environment_id; never show only the infra for one pre-selected environment.
16. CD image defaults to <+artifact.image> — for Deploy-stage verify, recommend the service artifact expression over a static tag from signing. Warn when static image ≠ service default tag.
17. Preflight delegates before CD update — harness_list(resource_type="delegate") or harness_execute(test_connection) on the K8s connector used in stepGroupInfra. Abort or warn if DELEGATE_NOT_AVAILABLE is likely (connector has delegateSelectors with no active delegate).
18. CD Deploy stage YAML requirements — new Deploy stages need failureStrategies: StageRollback, rollbackSteps with K8sRollingRollback + spec: {}, and CI stages need MarkAsFailure when missing. See references/cd-containerized-step-group.md.

Full phase prompts: references/interactive-wizard-flow.md.

Instructions

Wizard phases

After Phase 9 confirm → insert step, harness_update, then provide summary (do not run the pipeline).

Supported stage types

CD edge case

If no Deployment stage and user chose CD verify:

No CD Deploy stage yet. We can add a Deployment stage with a containerized step group and place Artifact Verification before deploy.

Run Phase 3b (service, environment, infrastructure, stepGroupInfra) — see references/cd-containerized-step-group.md.

Preflight before CD stage write

1. harness_get the K8s connector used in stepGroupInfra — note delegateSelectors.
2. harness_list(resource_type="delegate") — confirm an active delegate matches required selectors (e.g. ssca-prod2-at). Warn before harness_update if none match.
3. harness_get(resource_type="service") — note primary artifact tag; if user chose a static verify image, warn when it differs from the service default.

CD Deploy stage YAML (append to pipeline)

When adding a new Deploy stage, include all required blocks (API rejects incomplete YAML):

    - stage:
        name: Deploy
        identifier: Deploy
        type: Deployment
        spec:
          deploymentType: Kubernetes
          service:
            serviceRef: <service_id>
          environment:
            environmentRef: <env_id>
            infrastructureDefinitions:
              - identifier: <infra_id>
          execution:
            steps:
              - stepGroup:
                  identifier: scs_before_deploy
                  name: Supply Chain Security
                  stepGroupInfra:
                    type: KubernetesDirect
                    spec:
                      connectorRef: <k8s_connector>
                      namespace: <namespace>
                  steps:
                    - step:
                        identifier: artifactverification_cd
                        name: Artifact Verification
                        type: SscaArtifactVerification
                        spec:
                          source:
                            type: docker
                            spec:
                              connector: <registry_connector>
                              image: <+artifact.image>
                          verifySign:
                            type: keyless
                            spec:
                              oidcProvider: harness
                        timeout: 15m
              - step:
                  identifier: rolling_deployment
                  name: Rolling Deployment
                  type: K8sRollingDeploy
                  spec:
                    skipDryRun: false
                  timeout: 10m
            rollbackSteps:
              - step:
                  identifier: rollback
                  name: Rollback
                  type: K8sRollingRollback
                  spec: {}
                  timeout: 10m
        failureStrategies:
          - onFailure:
              errors: [AllErrors]
              action:
                type: StageRollback

Also ensure existing CI stages have failureStrategies: MarkAsFailure when missing.

Check prerequisites

1. Artifact signing — pipeline contains SscaArtifactSigning (or user confirms signature exists).
2. Public key secret (key-based) — file secret with Cosign public key matching signing private key.

Extract context from pipeline YAML

From SscaArtifactSigning (if present), copy source and map signing → verification:

Generate Artifact Verification step YAML

CI — Docker Registry, key-based verify (Harness docs):

- step:
    identifier: artifactverification
    name: Artifact Verification
    type: SscaArtifactVerification
    spec:
      source:
        type: docker
        spec:
          connector: lavakush07
          image: lavakush07/easy-buggy-app:v5
      verifySign:
        type: cosign
        spec:
          public_key: account.cosign_public_key
    timeout: 15m

Keyless verify (when signing used keyless Harness OIDC):

      verifySign:
        type: keyless
        spec:
          oidcProvider: harness

If API validation rejects flat keyless, retry nested cosign wrapper — see references/artifact-verification-step.md.

HAR verify:

      source:
        type: har
        spec:
          registry: prod_har
          image: my-service:v3

CD Deploy — same step type inside containerized stepGroup; use <+artifact.image> for image when verifying service artifacts.

Full provider mapping: references/artifact-verification-step.md.

Insert step into pipeline YAML

Critical: Use the exact yamlPipeline from harness_get as the base. Insert or update only SscaArtifactVerification (and CD step group infra when applicable). Never add HarnessSAST, STO scanners, or other steps — signing/verification skills do not configure code scan.

• Insert at Phase 3 placement — after artifactsigning when possible.
• Do not modify unrelated steps.
• Step identifier: artifactverification (use artifactverification_cd in CD when CI already has one).
• CD: inside containerized step group only.