feat(ci): add imagetools inspection

Author: tobiasehlert

.github/workflows/build.yml

@@ -218,14 +218,24 @@ jobs:
           cosign sign --yes \
             ghcr.io/${{ github.repository }}@${{ steps.docker_build.outputs.digest }}
 
-      - name: Inspect images
+      - name: Inspect images (GitHub Container Registry)
         run: |
-          echo "::group::DockerHub"
-          docker buildx imagetools inspect ${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
+          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
+
+          echo "::group::Manifest"
+          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }} --format '{{ json .Manifest }}'
           echo "::endgroup::"
 
-          echo "::group::GitHub Container Registry"
-          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }}
+          echo "::group::Image (linux/amd64)"
+          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }} --format '{{ json (index .Image "linux/amd64") }}'
+          echo "::endgroup::"
+
+          echo "::group::Provenance (linux/amd64)"
+          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }} --format '{{ json (index .Provenance "linux/amd64") }}'
+          echo "::endgroup::"
+
+          echo "::group::SBOM (linux/amd64)"
+          docker buildx imagetools inspect ghcr.io/${{ github.repository }}:${{ steps.docker_meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64") }}'
           echo "::endgroup::"
 
       - name: Verify cosign signatures