Test artifact attestation
Attest test fixtures, evaluation outputs, and Playwright snapshots so downstream consumers can verify exactly what was tested.
Test artifact attestation
Vitrified attestation isn't only for release binaries. It's useful any time you need to prove later that a specific byte sequence existed at a specific moment — including test artifacts.
Common cases:
- Playwright snapshots — attest the snapshot images so changes are auditable.
- AI evaluation results — attest the eval dataset, the model output, and the scoring result together so the eval is reproducible and the result is independently verifiable.
- Regression fixtures — attest the input fixture + expected output so the regression test contract is provable.
- Compliance artifacts — attest auditor-requested reports (SOC 2 evidence, GDPR data-mapping outputs, etc.) so the auditor sees a verifiable timestamp on the artifact they reviewed.
Pattern: attest the artifact inline in your test
import { test, expect } from "@playwright/test";
import { Vitrified } from "@vitrified/sdk";
const vitrified = new Vitrified({ apiKey: process.env.VITRIFIED_API_KEY });
test("homepage renders with the expected hero copy", async ({ page }) => {
await page.goto("/");
// Capture a screenshot artifact.
const screenshot = await page.screenshot({ path: "./test-results/homepage.png" });
// Attest the artifact as part of the test record.
const digest = await vitrified.hashBytes(screenshot);
const submission = await vitrified.attestations.create({
artifact: { sha256: digest },
metadata: {
schema: "generic",
kind: "playwright.screenshot",
test: "homepage renders with the expected hero copy",
ci_run: process.env.GITHUB_RUN_ID ?? "local",
commit: process.env.GITHUB_SHA ?? "local",
},
idempotencyKey: `screenshot:homepage:${process.env.GITHUB_RUN_ID ?? "local"}`,
});
console.log(`Attested screenshot: ${submission.id}`);
await expect(page.getByRole("heading", { level: 1 })).toContainText("Vitrified");
});The idempotencyKey ensures the same CI run doesn't double-attest if the test is retried.
Pattern: attest fixtures alongside the test run
For larger fixtures (test datasets, evaluation outputs, golden files), attest them once per CI run rather than per test:
import { globalSetup } from "@playwright/test";
import { Vitrified } from "@vitrified/sdk";
export default async function () {
const vitrified = new Vitrified({ apiKey: process.env.VITRIFIED_API_KEY });
const digest = await vitrified.hashFile("./test/fixtures/dataset.tar.gz");
await vitrified.attestations.create({
artifact: { sha256: digest },
metadata: {
schema: "generic",
kind: "test.fixture",
name: "playwright-dataset",
version: process.env.FIXTURE_VERSION,
},
idempotencyKey: `fixture:playwright-dataset:${process.env.FIXTURE_VERSION}`,
});
}Pattern: attest AI evaluation outputs
For model evaluations where downstream consumers need to confirm "this model output came from this input on this date":
from vitrified import Vitrified
vitrified = Vitrified(api_key=os.environ["VITRIFIED_API_KEY"])
# Attest the eval dataset.
dataset_digest = await vitrified.hash_file("./eval/dataset.jsonl")
dataset_sub = await vitrified.attestations.create(
artifact={"sha256": dataset_digest},
metadata={
"schema": "generic",
"kind": "ai.eval.dataset",
"name": "regression-suite-q3",
"size_records": 10_000,
},
)
# Run the eval and write outputs.
outputs = run_eval("./eval/dataset.jsonl")
write_jsonl("./eval/outputs.jsonl", outputs)
# Attest the outputs, referencing the dataset attestation by submission ID.
outputs_digest = await vitrified.hash_file("./eval/outputs.jsonl")
await vitrified.attestations.create(
artifact={"sha256": outputs_digest},
metadata={
"schema": "generic",
"kind": "ai.eval.output",
"model": "claude-sonnet-4-6",
"dataset_submission": dataset_sub.id,
"score": 0.94,
},
)A downstream consumer can fetch both bundles, verify them, and confirm that the output was produced from that exact dataset by that model.
See also
- Concepts: proof bundle — the bundle shape your tests produce.
- CI build attestation — attesting release binaries.
CI build attestation
Attest every CI build artifact automatically — GitHub Actions, CircleCI, GitLab CI, generic shell.
API reference
The Vitrified REST API: authentication, base URL, resource shapes, error envelope, and the live endpoint reference.
Was this page helpful?