From 4a262d124b62deaed78b5535875c501089ab16aa Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 25 Jun 2026 09:12:06 +0100
Subject: [PATCH] feat(ci): attest build provenance

Estate artifact-attestation rollout mirroring the proven exemplar.
Attests: container image (container.yml) + release binaries release/* (release.yml).
---
 .github/workflows/container.yml | 9 +++++++++
 .github/workflows/release.yml   | 6 ++++++
 2 files changed, 15 insertions(+)

diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index 3b04b14..c72fc97 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -16,6 +16,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
     steps:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -37,6 +39,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=sha
       - name: Build and push
+        id: push
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v5
         with:
           context: .
@@ -46,3 +49,9 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      - name: Attest container provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2155458..b7ecd34 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -134,6 +134,8 @@ jobs:
     needs: [build-binaries, build-deb, build-rpm]
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Download all artifacts
@@ -152,3 +154,7 @@ jobs:
           files: release/*
           generate_release_notes: true
           draft: false
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: 'release/*'