Add Artifact Attestations to Workflow

Add SLSA build-provenance attestations to existing GitHub Actions workflows for Docker container images.

Steps

1. Find existing workflow files in .github/workflows/ that contain docker/build-push-action or similar steps. Note that composite actions may be used — read both the composite action and the calling workflow simultaneously.

1. Enable OIDC & Attestations permissions

In each workflow's top-level permissions: block, grant both the OIDC token and attestations write privileges:

``yaml permissions: id-token: write attestations: write contents: read # (existing) packages: write # (existing) ``

1. Log in to container registries

Ensure authentication steps exist for each registry you'll attest against. Judge whether there are omissions based on the implemented content, rather than always logging into all registries.

```yaml - name: Login to GHCR uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }}

- name: Login to Docker Hub uses: docker/login-action@v3 with: registry: index.docker.io username: ${{ secrets.DOCKERHUBUSERNAME }} password: ${{ secrets.DOCKERHUBTOKEN }}

- name: Login to Quay uses: docker/login-action@v3 with: registry: quay.io username: ${{ secrets.QUAYUSERNAME }} password: ${{ secrets.QUAYTOKEN }} ```

1. Build & push image, capturing the digest

Use docker/build-push-action@v* with an id to reference its output. Judge tags based on implemented content.

``yaml - name: Build and push image id: buildpush uses: docker/build-push-action@v5 with: context: . push: true tags: | ghcr.io/${{ github.repository }}:latest index.docker.io/${{ secrets.DOCKERHUBUSERNAME }}/your-repo:latest quay.io/${{ github.repository_owner }}/your-repo:latest ``

1. Add attestation steps

After the build_push step, insert one actions/attest-build-provenance@v3 invocation per registry. The subject-name is the full image name without a tag. The subject-digest comes from the build step's output. Judge which registries to use based on implemented content.

```yaml - name: Attest GHCR image uses: actions/attest-build-provenance@v3 with: subject-name: ghcr.io/${{ github.repository }} subject-digest: ${{ steps.build_push.outputs.digest }}

- name: Attest Docker Hub image uses: actions/attest-build-provenance@v3 with: subject-name: index.docker.io/${{ secrets.DOCKERHUBUSERNAME }}/your-repo subject-digest: ${{ steps.buildpush.outputs.digest }}

- name: Attest Quay image uses: actions/attest-build-provenance@v3 with: subject-name: quay.io/${{ github.repositoryowner }}/your-repo subject-digest: ${{ steps.buildpush.outputs.digest }} ```

1. Commit changes

Write the git commit message in English.

``bash git add .github/workflows/docker_publish.yml # or whatever files you modified git commit --signoff -m "ci: add build-provenance attestations for container images" ``

1. Ask the user to push

Tell the user to manually push the changes and verify attestations are created successfully. DO NOT perform a git push.