ci: attest umbrella chart provenance; advance backend images to attested tags

[mitasovr]

Summary

Follow-up to #1280 closing the two remaining provenance gaps.

1. Umbrella chart attestation

publish-chart now parses the chart's OCI digest from helm push output and attests it with actions/attest-build-provenance@v2 (push-to-registry: true) — the same keyless SLSA contract as the container images:

gh attestation verify oci://ghcr.io/constructorfabric/charts/insight:<version> \
  --repo constructorfabric/insight

2. Backend images: chart pins predate attestation

The chart currently pins all three backend services (api-gateway, analytics-api, identity) to 2026.06.09.10.55-9ef2224 — built before the attestation steps landed, so gh attestation verify fails for every chart-referenced backend image. The attested rebuilds from #1280 were never promoted into the chart: bump-descriptors committed in that run (which skips publish-chart), and the follow-up run no longer matched the backend path filters.

Rebuild markers in the three service Dockerfiles make the merge of this PR rebuild + attest all three images; publish-chart then advances their appVersions and publishes an umbrella whose pinned backend tags are all attested — and the chart artifact itself now carries provenance too.

Expected CI flow on merge (single run)

changes flags all three backend services → rebuild + push + attest ×3 → connector matrix empty → bump-descriptors skipped → publish-chart runs in the same run: bumps three subchart appVersions, patch-bumps umbrella, pushes the chart, attests the chart digest.

Known-red check

Run E2E suite is red on every PR (pre-existing cost_cents migration mismatch on the e2e rig) — unrelated, tracked separately.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Enhanced CI/CD pipeline to capture and validate artifact metadata during chart publishing.
  • Updated Docker image build configurations to support improved artifact tracking and provenance.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR enhances the container image publishing pipeline to include SLSA provenance attestation. The workflow now extracts OCI digests from published Helm charts and creates keyless provenance attestations. Dockerfile rebuild markers are added to signal that container images should be republished to align with the new attestation capability.

Changes

SLSA Provenance for Published Chart

Layer / File(s)	Summary
Helm push digest extraction and provenance attestation .github/workflows/build-images.yml	The helm push step now captures output, extracts the OCI digest, and emits it as a workflow output. A new provenance attestation step immediately follows, using actions/attest-build-provenance@v2 to bind keyless SLSA provenance to the extracted digest and push it to the registry.
Container service Dockerfile rebuild markers src/backend/services/analytics-api/Dockerfile, src/backend/services/api-gateway/Dockerfile, src/backend/services/identity/Dockerfile	Rebuild marker comment blocks added to the top of each service Dockerfile to indicate that container images should be republished so chart-pinned tags advance to SLSA-attested versions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A hop through provenance, said the swift rabbit,
Where digests are parsed and attestations inhabit,
SLSA marks the way, from the Helm to the chart,
Each service renewed, from the finish to start! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the two main changes: adding SLSA provenance attestation to the umbrella chart and rebuilding backend images to get attested tags.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/build-images.yml (1)

808-808: 💤 Low value

Consider pinning the attestation action to a commit SHA.

The workflow uses actions/attest-build-provenance@v2, which is a moving tag. For supply chain security, consider pinning to a specific commit SHA (e.g., actions/attest-build-provenance@<commit-sha> # v2.x.x).

This would align with the existing practice for docker/build-push-action at lines 206, 252, 295, 352, 393, and 440, where commit SHAs are used.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-images.yml at line 808, The workflow uses the moving
tag actions/attest-build-provenance@v2; replace that with a pinned commit SHA
(e.g., actions/attest-build-provenance@<commit-sha> # v2.x.x) to avoid using a
mutable tag—update the step referencing actions/attest-build-provenance@v2 to
the specific commit SHA and add an inline comment with the corresponding v2.x.x
version for clarity and consistency with the other pinned actions.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/build-images.yml:
- Line 808: The workflow uses the moving tag actions/attest-build-provenance@v2;
replace that with a pinned commit SHA (e.g.,
actions/attest-build-provenance@<commit-sha> # v2.x.x) to avoid using a mutable
tag—update the step referencing actions/attest-build-provenance@v2 to the
specific commit SHA and add an inline comment with the corresponding v2.x.x
version for clarity and consistency with the other pinned actions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 54727ec4-8f02-46e6-bb41-8bdd0b1b5d4f

📥 Commits

Reviewing files that changed from the base of the PR and between 06e5bff and b8902c0.

📒 Files selected for processing (4)

• .github/workflows/build-images.yml
• src/backend/services/analytics-api/Dockerfile
• src/backend/services/api-gateway/Dockerfile
• src/backend/services/identity/Dockerfile