From 9a81b763983ed9a16354be1d80062981a1b3ecb3 Mon Sep 17 00:00:00 2001 From: Aarnav Tale Date: Sun, 22 Jun 2025 17:28:19 -0400 Subject: [PATCH] feat: add provenance attestations --- .github/workflows/next.yaml | 8 ++++++++ .github/workflows/release.yaml | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/.github/workflows/next.yaml b/.github/workflows/next.yaml index dbabedd..7129d52 100644 --- a/.github/workflows/next.yaml +++ b/.github/workflows/next.yaml @@ -46,6 +46,7 @@ jobs: - name: Build and push Docker image uses: docker/build-push-action@v6 + id: push with: context: . file: ./Dockerfile @@ -55,3 +56,10 @@ jobs: platforms: linux/amd64, linux/arm64 cache-from: type=gha cache-to: type=gha,mode=max + - name: Attest + uses: actions/attest-build-provenance@v2 + id: attest + with: + subject-name: ghcr.io/${{ github.repository }} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e21be79..b7442cf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -44,6 +44,7 @@ jobs: - name: Build and push Docker image uses: docker/build-push-action@v6 + id: push with: context: . file: ./Dockerfile @@ -53,3 +54,10 @@ jobs: platforms: linux/amd64, linux/arm64 cache-from: type=gha cache-to: type=gha,mode=max + - name: Attest + uses: actions/attest-build-provenance@v2 + id: attest + with: + subject-name: ghcr.io/${{ github.repository }} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true