Generate provenance for container images

Signed-off-by: Stefan Prodan <[email protected]>

Author: stefanprodan

.github/workflows/release.yaml

@@ -129,9 +129,9 @@ jobs:
   dockerhub-provenance:
     needs: [release]
     permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to the release.
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for uploading attestations.
     uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
     with:
       image: ${{ needs.release.outputs.image_url }}
@@ -143,9 +143,9 @@ jobs:
   ghcr-provenance:
     needs: [release]
     permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to the release.
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for uploading attestations.
     uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
     with:
       image: ghcr.io/${{ needs.release.outputs.image_url }}