The gittuf GitHub App

The gittuf GitHub app can be installed on a repository to observe pull request approvals and merges. The app records attestations for these events, allowing developers to continue using GitHub’s pull request workflow and code review tools while meeting gittuf policies. The gittuf community operates an instance of this app.

Next: Rule Files

Now that the root of trust is set up, let’s take a look at how we can define the security policy for the repository using rule files.