add cli container provenance (#334)

* generate cli container provenance Signed-off-by: Spencer Schrock <[email protected]> * tag the cli container with the release tag Signed-off-by: Spencer Schrock <[email protected]> --------- Signed-off-by: Spencer Schrock <[email protected]>
sigstore · Dec 12, 2024 · 6b79300 · 6b79300
1 parent 49cca7c
commit 6b79300
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -73,7 +73,7 @@ jobs:
           containerfiles: |
             ./Containerfile
           image: ghcr.io/sigstore/model-transparency-cli
-          tags: latest
+          tags: "latest ${{ github.event.release.tag_name }}"
           archs: amd64
           oci: false
 
@@ -99,6 +99,13 @@ jobs:
           tags: ${{ steps.build_image.outputs.tags }}
           registry: ghcr.io
 
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
+        with:
+          subject-name: ghcr.io/sigstore/model-transparency-cli
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+
   # TODO: Create and publish release notes
   # TODO: Generate SLSA provenance for the wheels
   # TODO: Sign artifacts with sigstore and publish to release page