---
title: "provenance"
lang: "en"
author: "Mohammad Abu Mattar"
canonical: https://mkabumattar.com/case-studies/tags/provenance
---

[Home](/)›[All Case Studies](/case-studies)›[All Tags](/case-studies/tags)›[Provenance](/case-studies/tags/provenance)

Tag

1Case Study

# #Provenance

CategoryAllDevOps (7)Cloud Native (4)Cloud Computing (3)Architecture (2)Reliability (2)Security (2)Cloud (1)Databases (1)Management (1)Platform Engineering (1)TagAllKubernetes (4)Argo CD (2)AWS (2)EKS (2)GitOps (2)SLSA (2)Supply Chain Security (2)Active Active (1)Alerting (1)Argo Rollouts (1)ArtifactHub (1)Backstage (1)CI/CD (1)Containers (1)Cosign (1)Cost Optimization (1)Cutover (1)Database Migration (1)Error Budget (1)Failover (1)FinOps (1)Golden Paths (1)Helm (1)High Availability (1)Idempotency (1)Internal Developer Platform (1)Logical Replication (1)Microservices (1)Migration (1)Multi Region (1)Observability (1)On Call (1)Payments (1)PostgreSQL (1)Prometheus (1)Provenance (1)RDS (1)Rollback (1)RPO (1)RTO (1)Savings Plans (1)Self Service (1)Sigstore (1)SLO (1)SRE (1)Strangler Pattern (1)Terraform (1)Traffic Shifting (1)Trivy (1)Wolfi (1)Zero Downtime (1)SortNewest firstOldest firstA to ZShortest read first

[![Hardening a CI/CD Supply Chain to SLSA Level 3](/_astro/hero.CMArPlpu_Z2bXFaz.webp)](/case-studies/post/cicd-supply-chain-slsa-level-3)

## [Hardening a CI/CD Supply Chain to SLSA Level 3](/case-studies/post/cicd-supply-chain-slsa-level-3)

-   [Security](/case-studies/categories/security)
-   [DevOps](/case-studies/categories/devops)
-   09 Sept 2026
-   11 Mins read

The question that started this was from an auditor, and it was a fair one: can you prove that the container running in production is the one your pipeline built from the commit you think it was? We ha

[#SLSA](/case-studies/tags/slsa)[#Supply Chain Security](/case-studies/tags/supply-chain-security)[#CI/CD](/case-studies/tags/cicd)+4 tags

[Read Case Study](/case-studies/post/cicd-supply-chain-slsa-level-3)