Verify Sign

Verify Sign

Add an Artifact Verification (SscaArtifactVerification) step to an existing Harness pipeline. The step verifies Cosign signatures on artifacts — typically immediately after SscaArtifactSigning.

This skill only works with existing pipelines — do not create standalone verification-only pipelines.

Prerequisites: Artifact must already be signed (typically via /sign-artifact / SscaArtifactSigning). Key-based verify requires the Cosign public key file secret matching the signing private key (/create-secret). If signing did not upload .sig to the registry, Harness pulls the signature from its database during verification.

Supported stages: CI, Security, and CD (Deployment in containerized step group before deploy).

Guide the user through a step-by-step interactive wizard (same UX as /sign-artifact):

• Wizard: references/interactive-wizard-flow.md
• UI ↔ YAML: references/artifact-verification-step.md
• CD containerized step groups: references/cd-containerized-step-group.md

Interaction model (mandatory)

1. One question per turn — use AskQuestion when available; otherwise numbered options with (Recommended).
2. Opening message — add Artifact Verification; mention signing prerequisite + HAR support.
3. Progress breadcrumb — after pipeline fetch: Pipeline · Placement · Source · Details · Verify · Submit
4. Record answers — running summary; do not re-ask unless the user changes direction.
5. Fetch before configure — harness_get before placement/source questions.
6. Show pipeline structure — highlight SscaArtifactSigning and connectors.
7. Infer source from signing — when one SscaArtifactSigning step exists, reuse its source. If multiple exist, ask which step to mirror.
8. Never guess image tags — default from signing step; ask if ambiguous.
9. Confirm before write — summary + harness_update only after user confirms.
10. Stop after update — after successful harness_update, provide a configuration summary and point the user to /run-pipeline to execute. Do not call harness_execute, poll executions, or run harness_diagnose in this skill (same pattern as /configure-repo-scan).
11. CD on CI-only pipeline — do not reject CD verify; run Phase 3b to add Deploy stage + containerized group.
12. Verify method must match signing — keyless ↔ keyless, keybased/cosign ↔ public key from same key pair.
13. Offer all three source tiles — Third-Party, HAR, and Harness Local Stage.
14. List all connectors in Phase 6 — same rules as /sign-artifact: harness_list with filters.type, all scopes, size: 100, paginate; never hand-pick a subset. See wizard Phase 6.
15. List all infrastructure in Phase 3b — harness_list per environment with filters.environment_id; never show only the infra for one pre-selected environment.
16. CD image defaults to <+artifact.image> — for Deploy-stage verify, recommend the service artifact expression over a static tag from signing. Warn when static image ≠ service default tag.
17. Preflight delegates before CD update — harness_list(resource_type="delegate") or harness_execute(test_connection) on the K8s connector used in stepGroupInfra. Abort or warn if DELEGATE_NOT_AVAILABLE is likely (connector has delegateSelectors with no active delegate).
18. CD Deploy stage YAML requirements — new Deploy stages need failureStrategies: StageRollback, rollbackSteps with K8sRollingRollback + spec: {}, and CI stages need MarkAsFailure when missing. See references/cd-containerized-step-group.md.

Full phase prompts: references/interactive-wizard-flow.md.

Instructions

Wizard phases

After Phase 9 confirm → insert step, harness_update, then provide summary (do not run the pipeline).

Supported stage types

CD edge case

If no Deployment stage and user chose CD verify:

No CD Deploy stage yet. We can add a Deployment stage with a containerized step group and place Artifact Verification before deploy.

Run Phase 3b (service, environment, infrastructure, stepGroupInfra) — see references/cd-containerized-step-group.md.

Preflight before CD stage write

1. harness_get the K8s connector used in stepGroupInfra — note delegateSelectors.
2. harness_list(resource_type="delegate") — confirm an active delegate matches required selectors (e.g. ssca-prod2-at). Warn before harness_update if none match.
3. harness_get(resource_type="service") — note primary artifact tag; if user chose a static verify image, warn when it differs from the service default.

CD Deploy stage YAML (append to pipeline)

When adding a new Deploy stage, include all required blocks (API rejects incomplete YAML):

    - stage:
        name: Deploy
        identifier: Deploy
        type: Deployment
        spec:
          deploymentType: Kubernetes
          service:
            serviceRef: <service_id>
          environment:
            environmentRef: <env_id>
            infrastructureDefinitions:
              - identifier: <infra_id>
          execution:
            steps:
              - stepGroup:
                  identifier: scs_before_deploy
                  name: Supply Chain Security
                  stepGroupInfra:
                    type: KubernetesDirect
                    spec:
                      connectorRef: <k8s_connector>
                      namespace: <namespace>
                  steps:
                    - step:
                        identifier: artifactverification_cd
                        name: Artifact Verification
                        type: SscaArtifactVerification
                        spec:
                          source:
                            type: docker
                            spec:
                              connector: <registry_connector>
                              image: <+artifact.image>
                          verifySign:
                            type: keyless
                            spec:
                              oidcProvider: harness
                        timeout: 15m
              - step:
                  identifier: rolling_deployment
                  name: Rolling Deployment
                  type: K8sRollingDeploy
                  spec:
                    skipDryRun: false
                  timeout: 10m
            rollbackSteps:
              - step:
                  identifier: rollback
                  name: Rollback
                  type: K8sRollingRollback
                  spec: {}
                  timeout: 10m
        failureStrategies:
          - onFailure:
              errors: [AllErrors]
              action:
                type: StageRollback

Also ensure existing CI stages have failureStrategies: MarkAsFailure when missing.

Check prerequisites

1. Artifact signing — pipeline contains SscaArtifactSigning (or user confirms signature exists).
2. Public key secret (key-based) — file secret with Cosign public key matching signing private key.

Extract context from pipeline YAML

From SscaArtifactSigning (if present), copy source and map signing → verification:

Generate Artifact Verification step YAML

CI — Docker Registry, key-based verify (Harness docs):

- step:
    identifier: artifactverification
    name: Artifact Verification
    type: SscaArtifactVerification
    spec:
      source:
        type: docker
        spec:
          connector: lavakush07
          image: lavakush07/easy-buggy-app:v5
      verifySign:
        type: cosign
        spec:
          public_key: account.cosign_public_key
    timeout: 15m

Keyless verify (when signing used keyless Harness OIDC):

      verifySign:
        type: keyless
        spec:
          oidcProvider: harness

If API validation rejects flat keyless, retry nested cosign wrapper — see references/artifact-verification-step.md.

HAR verify:

      source:
        type: har
        spec:
          registry: prod_har
          image: my-service:v3

CD Deploy — same step type inside containerized stepGroup; use <+artifact.image> for image when verifying service artifacts.

Full provider mapping: references/artifact-verification-step.md.

Insert step into pipeline YAML

Critical: Use the exact yamlPipeline from harness_get as the base. Insert or update only SscaArtifactVerification (and CD step group infra when applicable). Never add HarnessSAST, STO scanners, or other steps — signing/verification skills do not configure code scan.

• Insert at Phase 3 placement — after artifactsigning when possible.
• Do not modify unrelated steps.
• Step identifier: artifactverification (use artifactverification_cd in CD when CI already has one).
• CD: inside containerized step group only.

Update pipeline via MCP

harness_update
  resource_type: pipeline
  resource_id: <pipeline_identifier>
  org_id: <organization>
  project_id: <project>
  body: { yamlPipeline: "<updated pipeline YAML>" }

On validation errors, check verifySign shape, image field, and public key secret refs.

Provide summary

Report the results to the user (same pattern as /configure-repo-scan — do not execute the pipeline):

## Artifact Verification Configured

**Pipeline:** <pipeline_name>
**Step:** Artifact Verification (SscaArtifactVerification)
**Location:** Stage "<stage_name>", <position>
**Source:** docker — <connector> — <image>
**Verify signature:** Keyless (Harness OIDC) — or as configured

**Pipeline URL:** https://app.harness.io/ng/account/<account_id>/module/ci/orgs/<org_id>/projects/<project_id>/pipelines/<pipeline_id>/pipeline-studio/

**Note:** Review the Artifact Verification step in Pipeline Studio to adjust Advanced settings.

### Next Steps
1. Run the pipeline via `/run-pipeline` to verify artifact verification executes successfully
2. If the run fails, diagnose with `/debug-pipeline`
3. View verification outcome on the execution **Supply Chain** tab
4. If **Failed**, confirm verify method matches signing; check public key for keybased
5. Add signing with `/sign-artifact` if signature was missing — ensure `uploadSignature.upload: true`
6. Add SBOM/SLSA if not present (`/manage-supply-chain` or pipeline `SscaOrchestration` / `provenance`)
7. Automate with `/create-trigger`

CD pipelines: note in the summary if runtime inputs (service artifact, environment, infrastructure, artifact tag/digest) will be required at run time — the user provides those via /run-pipeline or Harness UI Run. When running CI+CD, check runtime_input_template — service primaryArtifactRef: <+input> may need artifact tag/digest in inputs even when the template only shows build.

Examples

Verify after Artifact Signing

/verify-sign
Add artifact verification after artifactsigning — public key account.cosign_public_key

CD before deploy

/verify-sign
Verify signed artifact in deploy stage before K8s rolling deploy — keyless verify

HAR verification

/verify-sign
Verify signature for HAR image payment-service:v2 — same registry as signing step

Keyless verify (matches keyless signing)

/verify-sign
Verify with keyless Harness OIDC — same image as signing step

Performance Notes

• Only existing pipelines (may append Deploy stage).
• Wizard UX mandatory — one question per turn.
• Reuse signing source — same lowercase source.type and image as SscaArtifactSigning.
• Field is verifySign (camelCase) — not verify_attestation (SLSA) or signing.
• HAR is a first-class source — source.type: har; offer even if UI shows only two tiles.
• CD verification supported — containerized step group only; signing in Deploy is not supported.
• Do not execute pipelines in this skill — use /run-pipeline after configuration (same as /configure-repo-scan).
• Pair with /sign-artifact (sign) — verify method must match signing.

Troubleshooting

No Artifact Signing Step

• Add /sign-artifact first with signature upload or Harness DB signature storage.
• Scan for SscaArtifactSigning or identifier: artifactsigning.

Signature Verification Failed

• Verify method must match signing (keyless vs keybased/cosign).
• Keybased: use public key secret (signing uses private key).
• If .sig not in registry, signing step may not have set uploadSignature.upload: true (Harness default is unchecked). Update signing step and re-run, or rely on Harness DB signature storage.

Multiple Signing Steps

• Ask user which SscaArtifactSigning step to mirror for source, image, and verify method.

Vault Verify Failed

• Confirm Vault connector and public key path match the signing secret-manager block.

Wrong Image

• CI: use same image as signing step source.spec.image.
• CD: default to <+artifact.image> — static signing tag (e.g. :v5) may not match service artifact (e.g. :v24) and verification will fail or verify the wrong image.

CD Deploy Failed — No Delegate (DELEGATE_NOT_AVAILABLE)

• Symptom: Deploy fails immediately; message mentions missing delegate or selector mismatch (e.g. Delegate(s) don't have selectors [ssca-prod2-at]).
• Fix: start a delegate with matching selectors (/manage-delegates), or pick infra/K8s connector backed by an active delegate. Re-run after delegate is healthy.

CD YAML Validation Errors (new Deploy stage)

• failureStrategies: is missing — add StageRollback on the Deploy stage.
• rollbackSteps[0].step.spec: is missing — K8sRollingRollback requires spec: {}.
• See full template in references/cd-containerized-step-group.md.

YAML Validation Errors

• Step type must be SscaArtifactVerification.
• Docker source requires connector + image (not repo or image_path).
• verifySign: prefer flat type: keyless; keybased uses type: cosign + public_key.
• DUPLICATE_IDENTIFIER — rename artifactverification.

CD Step Errors

• Place inside stepGroup with stepGroupInfra — not top-level execution.steps.
• See references/cd-containerized-step-group.md.

User Chose CD on CI-Only Pipeline

• Expected — run Phase 3b; do not force CI-only unless user changes direction.

Incomplete connector / infrastructure list

• Use harness_list + filters: { type: "DockerRegistry" } (not harness_search or params.filterType). Query project, org, and account scopes. For infrastructure, list per environment with filters: { environment_id: "<env>" } — see wizard Phase 3b and Phase 6.

Pipeline Run Failed

• Use /run-pipeline to execute and /debug-pipeline to diagnose failures
• Missing runtime inputs: provide branch/tag, artifact tag/digest, or deploy inputs via /run-pipeline or Harness UI Run

MCP Errors

• CONNECTOR_NOT_FOUND — verify connector in Project Settings; re-run scoped harness_list.
• ACCESS_DENIED — PAT needs pipeline edit permission.
• harness_update timeout — retry once; provide YAML for manual paste if MCP keeps timing out.