attest build provenance

[jakoch]

• https://github.com/actions/attest-build-provenance?tab=readme-ov-file#container-image
• https://github.com/cli/cli?tab=readme-ov-file#verification-of-binaries

- name: Attest
  uses: actions/attest-build-provenance@v2
  id: attest
  with:
    subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
    subject-digest: ${{ steps.push.outputs.digest }}
    push-to-registry: true

• according to https://docs.docker.com/build/ci/github-actions/attestations/
  this means that we cant store the build image to disk and then push, we would need to directly push

  • This is because the local image store doesn't support loading images with attestations.