Generate attestation for gerenated docker image

Signed-off-by: Sylvain Rabot <[email protected]>

.dockerignore

@@ -0,0 +1,3 @@
+dist
+.go-build-flags
+.buildx-metadata.json

.github/workflows/release.yaml

@@ -79,5 +79,15 @@ jobs:
       run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
     - name: Build and push docker image
+      id: docker-build
       run: |
         make docker-buildx-push
+        jq -r '."image.name" | split(":"; null)[0] | ("image="+.)' < .buildx-metadata.json >> "$GITHUB_OUTPUT"
+        jq -r '."containerimage.digest" | ("digest="+.)' < .buildx-metadata.json >> "$GITHUB_OUTPUT"
+
+    - uses: actions/attest-build-provenance@v1
+      with:
+        subject-name: ${{ steps.docker-build.outputs.image }}
+        subject-digest: ${{ steps.docker-build.outputs.digest }}
+        push-to-registry: true
+

.gitignore

@@ -2,3 +2,4 @@ dist
 .vscode
 .go-build-flags
 go.work*
+.buildx-metadata.json

Makefile

@@ -111,6 +111,7 @@ DOCKER_BUILD_LABELS     += --label org.opencontainers.image.revision=$(GIT_REVIS
 DOCKER_BUILD_LABELS     += --label org.opencontainers.image.version=$(GIT_VERSION)
 DOCKER_BUILD_LABELS     += --label org.opencontainers.image.created=$(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
 DOCKER_BUILD_BUILD_ARGS ?= --build-arg=GO_VERSION=$(DOCKER_BUILD_GO_VERSION)
+DOCKER_BUILD_BUILD_ARGS += --metadata-file=.buildx-metadata.json
 DOCKER_BUILDX_PLATFORMS ?= linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
 
 ifeq ($(CI),true)