From 1a978745fcb97d5fe11f95c3da25951f87f9fec5 Mon Sep 17 00:00:00 2001 From: Varadraj75 Date: Fri, 5 Jun 2026 09:20:31 +0530 Subject: [PATCH 1/4] feat: add container image provenance attestation to shared workflow Adds actions/attest-build-provenance to the docker-build job so all components using this shared workflow (operator, kubevuln, storage, node-agent, synchronizer, http-request, prometheus-exporter) get SLSA provenance attestation on every release. Captures the image digest from the build-push step and attests it using subject-digest for accurate per-digest attestation. Also adds attestations: write permission required by the action. Signed-off-by: Varadraj75 --- .github/workflows/incluster-comp-pr-merged.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml index 2f733b9..e035c8a 100644 --- a/.github/workflows/incluster-comp-pr-merged.yaml +++ b/.github/workflows/incluster-comp-pr-merged.yaml @@ -128,6 +128,7 @@ jobs: packages: write contents: read pull-requests: read + attestations: write steps: # - name: Exit if not on master branch @@ -167,6 +168,7 @@ jobs: password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }} - name: Build and push + id: build uses: docker/build-push-action@v6 with: context: . @@ -178,6 +180,13 @@ jobs: cache-to: type=gha,mode=max push: true + - name: Attest image provenance + uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0 + with: + subject-name: ${{ inputs.IMAGE_NAME }} + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Install cosign uses: sigstore/cosign-installer@main with: From d58870c813eab03652c76b798ae4567b4ef4a854 Mon Sep 17 00:00:00 2001 From: Varadraj75 Date: Fri, 5 Jun 2026 09:25:14 +0530 Subject: [PATCH 2/4] fix: use exact pushed image reference for attestation subject-name Signed-off-by: Varadraj75 --- .github/workflows/incluster-comp-pr-merged.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml index e035c8a..851bdb1 100644 --- a/.github/workflows/incluster-comp-pr-merged.yaml +++ b/.github/workflows/incluster-comp-pr-merged.yaml @@ -183,7 +183,7 @@ jobs: - name: Attest image provenance uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0 with: - subject-name: ${{ inputs.IMAGE_NAME }} + subject-name: ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }} subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true From bca20199df675999d006723c44d28247e01d959b Mon Sep 17 00:00:00 2001 From: Varadraj75 Date: Fri, 5 Jun 2026 22:04:06 +0530 Subject: [PATCH 3/4] fix: remove tag from subject-name as required by push-to-registry mode When push-to-registry: true, subject-name must be the fully-qualified image name without a tag. The digest in subject-digest already uniquely identifies the image. Signed-off-by: Varadraj75 --- .github/workflows/incluster-comp-pr-merged.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml index 851bdb1..e035c8a 100644 --- a/.github/workflows/incluster-comp-pr-merged.yaml +++ b/.github/workflows/incluster-comp-pr-merged.yaml @@ -183,7 +183,7 @@ jobs: - name: Attest image provenance uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0 with: - subject-name: ${{ inputs.IMAGE_NAME }}:${{ steps.image-prerelease-tag.outputs.IMAGE_TAG_PRERELEASE }} + subject-name: ${{ inputs.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true From 8d057e524e4b5b00759cc8227dbaef10a6fbd0b3 Mon Sep 17 00:00:00 2001 From: Varadraj75 Date: Sat, 6 Jun 2026 19:00:50 +0530 Subject: [PATCH 4/4] fix: update to actions/attest@v4.1.0 replacing deprecated attest-build-provenance actions/attest-build-provenance v4+ is a wrapper on actions/attest. New implementations should use actions/attest directly per upstream guidance. Signed-off-by: Varadraj75 --- .github/workflows/incluster-comp-pr-merged.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml index e035c8a..0cf0219 100644 --- a/.github/workflows/incluster-comp-pr-merged.yaml +++ b/.github/workflows/incluster-comp-pr-merged.yaml @@ -181,7 +181,7 @@ jobs: push: true - name: Attest image provenance - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0 + uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 with: subject-name: ${{ inputs.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }}