ci: enable attestations again

.github/workflows/release-image.yaml

@@ -12,6 +12,10 @@ on:
       short-tag:
         required: true
         type: string
+      create-attestation:
+        required: false
+        type: boolean
+        default: false
     secrets:
       github-token:
         required: true
@@ -58,3 +62,10 @@ jobs:
           platforms: linux/amd64,linux/arm64
           provenance: false
           sbom: false
+      - name: Generate artifact attestation
+        if: ${{ inputs.create-attestation }}
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/test-release.yaml

@@ -34,6 +34,7 @@ jobs:
       image-registry: ghcr.io
       image-registry-username: ${{ github.actor }}
       image-registry-password: ${{ secrets.GITHUB_TOKEN }}
+      create-attestation: true
   release_discussion:
     needs: release
     permissions:

docs/auto-labeler.md

@@ -5,7 +5,6 @@
 ```yaml
 - uses: github/ospo-reusable-workflows/.github/workflows/auto-labeler.yml@main
   permissions:
-    contents: write
     pull-requests: write
   with:
     # The name of the configuration file to use, default is release-drafter.yml

docs/release-image.md

@@ -16,6 +16,8 @@
     full-tag: v1.0.0
     # Short tag of the image, usually the major version (v1)
     short-tag: v1
+    # Flag to create an attestation
+    create-attestation: true
   secrets:
     # The GitHub token to use
     github-token: ${{ secrets.GITHUB_TOKEN }}