Add fallback for missing startup time

[cpetersen5]

Description

Fix for:

Error: signing ghcr.io/opencost/opencost@sha256:5f37f689557dbb6737a9182b70625bba55bbba843a2caaba5a79746945a56cc6: unmarshal Provenance predicate: parsing time "" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "2006"
error during command execution: signing ghcr.io/opencost/opencost@sha256:5f37f689557dbb6737a9182b70625bba55bbba843a2caaba5a79746945a56cc6: unmarshal Provenance predicate: parsing time "" as "2006-01-02T15:04:05Z07:00": cannot parse "" as "2006"
Error: Process completed with exit code 1.

Related Issues

N/A

User Impact

N/A

Testing

[Copilot]

Pull request overview

Adds a fallback timestamp in the reusable image-signing GitHub Action so provenance generation does not fail when the supplied workflow start time is empty.

Changes:

• Documents fallback behavior for the run-started-at input.
• Captures a UTC RFC3339-style timestamp at action start.
• Uses the fallback timestamp when STARTED_ON is empty before generating the SLSA predicate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mbolt35]

Looks good!