Skip to main content

Build Type: Jenkins

This is a SLSA Provenance buildType that describes the execution of a Jenkins workflow.

This build type was inspired by the GitHub Actions build type described here.


"buildType": ""

The Jenkins build type describes the execution of a Jenkins workflow that builds a software artifact.

Build Definition

External parameters

All external parameters are REQUIRED unless empty.

workflowobjectThe workflow that was run
workflow.namestringThe full name of the Jenkins job
workflow.repositorystringURI of the git repository (if exists)
workflow.refstringA git reference to the commit (if exists)
jobobjectThe currently running stage of the Jenkins job
job.jobNamestringThe stage name currently running
buildobjectThe specific build that generated the provenance
build.buildRunstringThe build run ID
build.buildUrlstringThe full web URL for the build


"externalParameters": {
"workflow": {
"name": "cimon-attest-tests/cimon-attest-pipeline-github",
"repository": "",
"ref": "main"
"job": {
"jobName": "Cimon Attest"
"build": {
"buildRun": "3",
"buildUrl": "http://jenkins.server/job/cimon-attest-tests/job/cimon-attest-pipeline-github/3/"

Internal parameters

All internal parameters are OPTIONAL. This build type doesn't use internal parameters.

Resolved Dependencies

The resolvedDependencies SHOULD contain an entry identifying the resolved git commit ID corresponding to externalParameters.workflow. The dependency's URI MUST be in SPDX Download Location format, i.e., "git+" + workflow.uri + "@" + workflow.ref.


"resolvedDependencies": [
"uri": "git+",
"digest": {
"gitCommit": "d1f094f11a55eb186b4900871740848a773a4924"

Run Details


The MUST represent the entity that generated the provenance, as per the SLSA Provenance documentation. In the case of Jenkins, this should represent the agent that have been running the build. Based on this information, the provenance consumer can decide whether the build environment is secure enough to trust the produced attestation.


"builder": {
"id": "http://jenkins.server/computer/jenkins-agent"


The invocationId SHOULD be set to the Jenkins URL for the specific run.


"metadata": {
"invocationID": "",