ci: Enable build provenance attestation

Will enrich the manifests with detailed information how the build was done which shall further improve transparency. Also set reproducible to true as this is now the case. Signed-off-by: Jan Kiszka <[email protected]>
siemens · Mar 8, 2024 · 9103719 · 9103719
1 parent 81f6c50
commit 9103719
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -41,5 +41,6 @@ jobs:
           build-args: |
             SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
             DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          provenance: mode=max,reproducible=true
           outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/${{ matrix.image-name }}
diff --git a/.github/workflows/next.yml b/.github/workflows/next.yml
@@ -102,5 +102,6 @@ jobs:
           build-args: |
             SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
             DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          provenance: mode=max,reproducible=true
           outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/${{ matrix.image-name }}:next
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -32,6 +32,7 @@ jobs:
           build-args: |
             SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
             DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          provenance: mode=max,reproducible=true
           outputs: type=registry,rewrite-timestamp=true
           tags: |
             ghcr.io/siemens/kas/${{ matrix.image-name }}