chore: fix verify step and linter findings

Author: rjaegers

.github/workflows/build-push.yml

@@ -130,7 +130,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh attestation verify oci://${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }} --owner "$GITHUB_REPOSITORY_OWNER"
+          gh attestation verify --owner "$GITHUB_REPOSITORY_OWNER" oci://${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}@${{ steps.build-and-push.outputs.digest }}
   acceptance-test:
     if: github.event_name == 'pull_request'
     needs: build-push

.github/workflows/package-published.yml

@@ -5,6 +5,9 @@ on:
   registry_package:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   attach-provenance-to-release:
     runs-on: ubuntu-latest