chore(ci): enable reproducible Docker builds with provenance and SLSA attestations

Author: dominiccreates

infrastructure/ci/docker-build-pipeline.yml

@@ -20,6 +20,8 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Set source date epoch
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -37,6 +39,10 @@ jobs:
           push: false
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          provenance: mode=max
+          sbom: true
+          attestations: true
+          build-args: SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.sha }}
 
   test:
@@ -59,6 +65,10 @@ jobs:
           target: test
           push: false
           cache-from: type=gha
+          provenance: mode=max
+          sbom: true
+          attestations: true
+          build-args: SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test-${{ github.sha }}
 
   security-scan:
@@ -70,6 +80,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Set source date epoch
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -82,6 +95,10 @@ jobs:
           push: false
           load: true
           cache-from: type=gha
+          provenance: mode=max
+          sbom: true
+          attestations: true
+          build-args: SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan-${{ github.sha }}
 
       - name: Run Trivy vulnerability scan
@@ -106,6 +123,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Set source date epoch
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -135,6 +155,10 @@ jobs:
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          provenance: mode=max
+          sbom: true
+          attestations: true
+          build-args: SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}