ci: attest umbrella chart provenance; advance backend images to attested tags

.github/workflows/build-images.yml

@@ -785,9 +785,31 @@ jobs:
             | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Helm push
+        id: helm_push
         run: |
-          helm push "dist/insight-${{ steps.umbrella.outputs.version }}.tgz" \
-            oci://ghcr.io/constructorfabric/charts
+          set -euo pipefail
+          OUT="$(helm push "dist/insight-${{ steps.umbrella.outputs.version }}.tgz" \
+            oci://ghcr.io/constructorfabric/charts 2>&1)"
+          echo "$OUT"
+          # helm push prints "Digest: sha256:..." — that digest is the chart's
+          # OCI manifest identity, which the attestation below binds to.
+          DIGEST="$(echo "$OUT" | sed -n 's/^Digest: //p')"
+          if [ -z "$DIGEST" ]; then
+            echo "ERROR: could not parse chart digest from helm push output" >&2
+            exit 1
+          fi
+          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
+
+      # Keyless SLSA provenance for the umbrella chart OCI artifact — same
+      # contract as the image attestations (see backend-api-gateway). Verify:
+      #   gh attestation verify oci://ghcr.io/constructorfabric/charts/insight:<ver> \
+      #     --repo constructorfabric/insight
+      - name: Attest chart provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/constructorfabric/charts/insight
+          subject-digest: ${{ steps.helm_push.outputs.digest }}
+          push-to-registry: true
 
       - name: Commit version bumps back to main
         env:

src/backend/services/analytics-api/Dockerfile

@@ -1,3 +1,6 @@
+# Rebuild marker (2026-06-11): republish so the chart-pinned tag advances to
+# an SLSA-attested image — current appVersion predates the provenance
+# attestation steps in build-images.yml.
 # Multi-stage build for Insight Analytics API
 #
 # Build context: src/backend/
@@ -49,4 +52,4 @@ USER 1000
 
 EXPOSE 8081
 
-CMD ["/app/analytics-api"]
+CMD ["/app/analytics-api"]

src/backend/services/api-gateway/Dockerfile

@@ -1,3 +1,6 @@
+# Rebuild marker (2026-06-11): republish so the chart-pinned tag advances to
+# an SLSA-attested image — current appVersion predates the provenance
+# attestation steps in build-images.yml.
 # Multi-stage build for Insight API Gateway
 #
 # Build context: src/backend/
@@ -63,4 +66,4 @@ USER 1000
 
 EXPOSE 8080
 
-CMD ["/app/insight-api-gateway", "-c", "/app/config/insight.yaml", "run"]
+CMD ["/app/insight-api-gateway", "-c", "/app/config/insight.yaml", "run"]

src/backend/services/identity/Dockerfile

@@ -1,3 +1,6 @@
+# Rebuild marker (2026-06-11): republish so the chart-pinned tag advances to
+# an SLSA-attested image — current appVersion predates the provenance
+# attestation steps in build-images.yml.
 # Identity Resolution — .NET 9 service.
 #
 # Build context: src/backend/services/identity/
@@ -26,4 +29,4 @@ RUN useradd -U -u 1000 appuser \
     && chown -R 1000:1000 /app
 USER 1000
 EXPOSE 8082
-ENTRYPOINT ["dotnet", "Insight.Identity.Api.dll"]
+ENTRYPOINT ["dotnet", "Insight.Identity.Api.dll"]