ci: Enable build provenance attestation

Will enrich the manifests with detailed information how the build was done which shall further improve transparency. Signed-off-by: Jan Kiszka <[email protected]>
siemens · Mar 8, 2024 · bf9835a · bf9835a
1 parent 81f6c50
commit bf9835a
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -41,5 +41,6 @@ jobs:
           build-args: |
             SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
             DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          provenance: mode=max
           outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/${{ matrix.image-name }}
diff --git a/.github/workflows/next.yml b/.github/workflows/next.yml
@@ -102,5 +102,6 @@ jobs:
           build-args: |
             SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
             DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          provenance: mode=max
           outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/${{ matrix.image-name }}:next
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -32,6 +32,7 @@ jobs:
           build-args: |
             SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
             DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          provenance: mode=max
           outputs: type=registry,rewrite-timestamp=true
           tags: |
             ghcr.io/siemens/kas/${{ matrix.image-name }}