Integrate CDK with GitHub Actions

01 Add the workflow

CDK authenticates using GitHub's OIDC token, so no long-lived secrets are stored in your repository. Add the action to the job that runs after deployment:

name: CDK Attestation
on:
  deployment_status:

jobs:
  attest:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # required for keyless signing
      contents: read
    steps:
      - uses: cdk-project/attest-action@v1
        with:
          policy: release-policy-v3

02 Point it at a policy

The policy input references a policy you've already defined in CDK — the same one your Policy Engine evaluates on every deployment. If you haven't created one yet, CDK ships a permissive default so this step never blocks your first attestation.

03 What you get

On the next deployment, this workflow produces a signed node in your Evidence Graph automatically:

• An attestation linking the deployment to its approving pull request
• A verified identity for whoever triggered the deployment
• A policy evaluation result, pass or fail
• A record visible immediately in the Enterprise console — no export required

Full example

A complete workflow, including the deployment step it runs alongside:

name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to production
        run: ./scripts/deploy.sh

  attest:
    needs: deploy
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: cdk-project/attest-action@v1
        with:
          policy: release-policy-v3

Next steps