chore(docker-ci): disable provenance/sbom + cancel superseded builds

[LucasSantana-Dev]

Summary

Reduces wasted CI/CD time on Docker builds by:

• Disabling SLSA provenance + SBOM attestation on all docker/build-push-action steps where attestations aren't used
• Adding job-level concurrency to cancel in-flight PR builds when a new push arrives

Changes

ci.yml

• Added concurrency: block to docker-build job to cancel superseded PR builds
• Added provenance: false, sbom: false to both build steps (initial + transient-failure retry)
• CI/PR images are never pushed to a registry, so SLSA attestation generation is pure overhead

docker-publish.yml

• Added provenance: false, sbom: false to the production image build step
• No provenance/cosign consumers found in the repository (grep confirmed)

Rationale

• Provenance/SBOM generation: Adds ~30-60s per image build with zero benefit when images aren't pushed (ci.yml) or don't require signed attestations (docker-publish.yml)
• Concurrency cancellation: Prevents stale/redundant builds from running when a PR receives a new push, freeing CI minutes

Testing

• YAML syntax validated via Python's yaml.safe_load() ✓
• actionlint passed on both workflows ✓
• No logic or behavior changes — purely optimization

---

Summary by cubic

Reduce Docker CI time by disabling SLSA provenance/SBOM and canceling superseded builds. Saves ~30–60s per build and avoids stale runs; no attestations are generated or uploaded.

• Refactors
  • .github/workflows/ci.yml: Added concurrency with group: docker-build-${{ github.ref }}-${{ matrix.service }} and cancel-in-progress: true to cancel superseded runs without canceling parallel matrix services.
  • .github/workflows/ci.yml: Set provenance: false and sbom: false on both docker/build-push-action steps (initial and retry); PR images are not pushed.
  • .github/workflows/docker-publish.yml: Set provenance: false and sbom: false on the production docker/build-push-action step.

^{Written for commit da991c6. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Improved Docker build workflow reliability by canceling superseded in-progress builds using per-branch/per-service concurrency with automatic cancellation.
  • Streamlined Docker image publishing and builds by disabling generation and attachment of Docker provenance and SBOM metadata.

[coderabbitai]

📝 Walkthrough

Walkthrough

Docker workflows now disable provenance and SBOM generation for image builds. The CI Docker build job also cancels superseded runs using a ref- and service-specific concurrency group.

Changes

Docker workflow configuration

Layer / File(s)	Summary
CI Docker build controls .github/workflows/ci.yml	The docker-build job adds ref- and service-scoped concurrency cancellation, and both its primary and retry builds disable provenance and SBOM generation.
Published image metadata controls .github/workflows/docker-publish.yml	The published Docker image build disables provenance and SBOM generation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• LucasSantana-Dev/Lucky#1061: Both changes modify the CI workflow’s Docker build job configuration.
• LucasSantana-Dev/Lucky#1706: Both changes modify Docker build action configuration in the CI workflow.

Suggested labels: infra

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main Docker CI changes: disabling provenance/SBOM and canceling superseded builds.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/docker-ci-provenance-concurrency

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 248-250: Update the workflow’s docker-build concurrency group to
include the matrix service identifier, while retaining the github.ref component
and cancel-in-progress behavior. Ensure each matrix child uses a distinct group
so builds for different services in the same ref do not cancel one another.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 99651a40-3a35-44d2-baa9-5545eacf2664

📥 Commits

Reviewing files that changed from the base of the PR and between 7d7324a and 115d323.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/docker-publish.yml

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Auto-approved: Clearly beneficial CI optimization: disables unused provenance/SBOM attestations (no consumers) and adds concurrency to cancel superseded PR builds, reducing wasted CI time without behavior changes.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud