The idea is to have a way to ensure that the artifacts were not tempered after the build. You can find details in the projects page: https://github.com/actions/attest-build-provenance There is also the docs page: https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds