security: verify docs-builder :edge attestation in consumer workflows

[cotti]

Summary

Consumer-side follow-up to #159 (fix/hardening-batch) that closes the
loop on #518.
After #159, both consumer paths that pull ghcr.io/elastic/docs-builder:edge
already resolve the mutable tag to an immutable RepoDigest. This PR
adds the missing step: verifying the SLSA build-provenance attestation
that docs-builder's prerelease.yml mints on every push, so we don't
just trust that a digest is stable but also who signed it.

Issue addressed

#	Issue	Fix
1	#518 (consumer, part 2/2)	.github/workflows/docs-deploy.yml (Pull and pin docs-builder image) and docs-builder/setup/action.yml (edge branch) now run gh attestation verify oci://${DIGEST} -R elastic/docs-builder between the digest resolution and any further use of the image. -R elastic/docs-builder constrains the attestation issuer so an attacker cannot publish a self-signed attestation under their own repo and have it accepted. Fails closed if the attestation is missing, malformed, or signed by an unexpected workflow.

Commits

• 0acc418 Verify docs-builder :edge attestation before use

⚠️ Merge ordering

Do not merge this PR until both of the following have happened:

1. elastic/docs-builder#PENDING (security/output-sanitizer) has merged.
2. The next prerelease.yml run on docs-builder main has completed successfully and pushed a new :edge digest with its attestation to ghcr.io/elastic/docs-builder.

If merged earlier, every docs-deploy.yml run on every consumer repo will fail at the verify step because no signed :edge digest exists yet. That's the intended fail-closed behaviour, but it would break deploys repo-wide.

This PR is kept in draft until that prerequisite is met. Convert to ready once a successful signed prerelease run is observable.

Test plan

• After producer ships and at least one signed :edge exists, run gh attestation verify oci://ghcr.io/elastic/docs-builder@<latest-edge-digest> -R elastic/docs-builder locally — should succeed.
• Open a same-repo docs PR after merge — Pull and pin docs-builder image step shows successful verification before container run.
• Temporarily point EDGE_IMAGE at a fork-built unsigned image (in a scratch branch) — verify the step fails closed with a clear error.

Made with Cursor