ci: attest

Author: BeryJu

.github/workflows/build-tag.yml

@@ -15,6 +15,11 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+      packages: write
+      contents: read
     outputs:
       release_upload_url: ${{ steps.create_release.outputs.upload_url }}
     steps:
@@ -36,6 +41,7 @@ jobs:
           tags: |
             type=raw,value=v${{ steps.vars.outputs.version }}
       - uses: docker/[email protected]
+        id: push
         with:
           tags: |
             ghcr.io/beryju/gravity:stable
@@ -47,6 +53,11 @@ jobs:
             BUILD=${{ steps.vars.outputs.build }}
             GIT_BUILD_HASH=release
           labels: ${{ steps.meta.outputs.labels }}
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/beryju/gravity
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
       - uses: actions/[email protected]
         id: create_release
         env:

.github/workflows/build.yml

@@ -15,6 +15,11 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+      packages: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-qemu-action@v3
@@ -34,6 +39,7 @@ jobs:
           tags: |
             type=raw,value=${{ steps.vars.outputs.sha }}
       - uses: docker/[email protected]
+        id: push
         with:
           tags: |
             ghcr.io/beryju/gravity:latest
@@ -45,6 +51,11 @@ jobs:
             BUILD=${{ steps.vars.outputs.build }}
             GIT_BUILD_HASH=${{ steps.vars.outputs.sha }}
           labels: ${{ steps.meta.outputs.labels }}
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/beryju/gravity
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: ${{ github.ref == 'refs/heads/main' }}
   build-cli:
     name: Build CLI
     runs-on: ubuntu-latest