GitHub: List artifact deployment records

← Orgs operations · Get started

Operation github.orgs_list_artifact_deployment_records

Provider route: GET /orgs/{org}/artifacts/{subject_digest}/metadata/deployment-records. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["orgs"]["orgsListArtifactDeploymentRecords"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.orgs.orgsListArtifactDeploymentRecords(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.orgs.orgs_list_artifact_deployment_records(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
$	object	Root	Additional keys: not allowed
path	object	Required within parent	Additional keys: not allowed
path.org	string	Required within parent
path.subject_digest	string	Required within parent	Maximum length: 71 Minimum length: 71 Pattern: ^sha256:[a-f0-9]{64}$

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
$	object	Root
deployment_records	array	Optional
deployment_records[]	Model	Each item	Expand List artifact deployment records — response body — deployment records item
total_count	JSON	Optional
total_count (anyOf 1)	integer	Alternative	The number of deployment records for this digest and organization
total_count (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:.[0-9]+)?(?:[eE][+-]?[0-9]+)?$

Referenced models: List artifact deployment records — response body — deployment records item

Schemas

List artifact deployment records — response body — deployment records item

Field	Type	Presence	Description and constraints
$	object	Root	Artifact Metadata Deployment Record
attestation_id	JSON	Optional
attestation_id (anyOf 1)	JSON	Alternative
attestation_id (anyOf 1) (anyOf 1)	integer	Alternative	The ID of the provenance attestation associated with the deployment record.
attestation_id (anyOf 1) (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
attestation_id (anyOf 2)	null	Alternative
cluster	string	Optional
created_at	string	Optional
deployment_name	string	Optional
digest	string	Optional
id	JSON	Optional
id (anyOf 1)	integer	Alternative
id (anyOf 2)	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
logical_environment	string	Optional
physical_environment	string	Optional
runtime_risks	array	Optional	A list of runtime risks associated with the deployment. Maximum items: 4 Unique items: true
runtime_risks[]	string	Each item	Known values: critical-resource, internet-exposed, lateral-movement, sensitive-data
tags	object	Optional	Additional keys: see wildcard field
tags.*	string	Additional keys
updated_at	string	Optional

Policy, approvals and errors

SDK function policy ID: github.orgs_list_artifact_deployment_records. Catalog operation: orgs/list-artifact-deployment-records. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source