ci(build): attach the full provenance and an SBOM to every image

- enable full provenance attestation explicitly for every image build - attach an SBOM attestation to every image, which lists every package of the image
2026-11-06 13:10:37 -04:00 · 2026-11-02 00:06:48 +01:00
parent a4b2b2ea4e
commit 70ba07947f
1 changed files with 2 additions and 0 deletions
@@ -103,6 +103,8 @@ jobs:
            SOURCE_DATE_EPOCH=${{ steps.args.outputs.epoch }}
            CREATED=${{ steps.args.outputs.created }}
            GIT_SHA=${{ steps.args.outputs.sha }}
+          provenance: mode=max
+          sbom: true

      - name: Upload the image
        uses: actions/upload-artifact@v7.0.2