From 70a31cc240a7ac77b8c42cf2bd901ace01e8068c Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 25 Jun 2026 09:04:46 +0100
Subject: [PATCH] feat(ci): attest container build provenance (exemplar for
 attestation rollout)

Adds GitHub native build-provenance attestation to the ghcr container publish:
id-token+attestations perms, id on the build-push step to capture the digest,
and an attest-build-provenance step binding the pushed image digest to this
build (push-to-registry so it travels with the image). Verify with
'gh attest verify oci://ghcr.io/<repo>:<tag> --repo <repo>'.

Exemplar validating the container-cluster pattern before the wider rollout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/publish-ghcr.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/publish-ghcr.yml b/.github/workflows/publish-ghcr.yml
index 5d3a8355..ebc18cd3 100644
--- a/.github/workflows/publish-ghcr.yml
+++ b/.github/workflows/publish-ghcr.yml
@@ -38,6 +38,11 @@ jobs:
     name: Publish Docker container
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      packages: write
+      id-token: write       # mint the OIDC token the attestation is signed with
+      attestations: write   # write the build-provenance attestation (the "claim")
     steps:
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -59,6 +64,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha
       - name: Build and push
+        id: push
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
         with:
           context: .
@@ -67,3 +73,14 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      # GitHub native artifact attestation (build provenance) for the pushed
+      # image — a signed, verifiable claim binding the image digest to this
+      # build. Verify with:
+      #   gh attest verify oci://ghcr.io/${{ github.repository }}:<tag> \
+      #     --repo ${{ github.repository }}
+      - name: Attest container provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-name: ghcr.io/${{ github.repository }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true