From 70ba07947ffc6d38fdb9d2e5aebda9efdf8ff5ad Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Thu, 29 Oct 2026 23:10:00 +0100
Subject: [PATCH] ci(build): attach the full provenance and an SBOM to every
 image

- enable full provenance attestation explicitly for every image build
- attach an SBOM attestation to every image, which lists every package of the image
---
 .github/workflows/build.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6505dbeaa9..10c0af64e3 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -103,6 +103,8 @@ jobs:
             SOURCE_DATE_EPOCH=${{ steps.args.outputs.epoch }}
             CREATED=${{ steps.args.outputs.created }}
             GIT_SHA=${{ steps.args.outputs.sha }}
+          provenance: mode=max
+          sbom: true
 
       - name: Upload the image
         uses: actions/upload-artifact@v7.0.2