feat: add Docker attest-images action for build provenance attestation

Author: Copilot

.github/workflows/docker-build-images.md

@@ -35,6 +35,7 @@ This includes [multi-platform](https://docs.docker.com/build/building/multi-plat
 - **`issues`**: `read`
 - **`packages`**: `write`
 - **`pull-requests`**: `read`
+- **`attestations`**: `write` (only required when `attest: true`)
 
 <!-- overview:end -->
 
@@ -58,6 +59,7 @@ jobs:
       issues: read
       packages: write
       pull-requests: read
+      attestations: write # only required when `attest: true`
     secrets:
       # Password or GitHub token (`packages:read` and `packages:write` scopes) configuration used to log against OCI registries.
       # Accepts either a single password/token string (default format) or a JSON object using the same keys as `oci-registry`.
@@ -178,6 +180,12 @@ jobs:
       #
       # Default: `true`
       sign: true
+
+      # Generate build provenance attestations for built images.
+      # See [attest-images](../../actions/docker/attest-images/README.md).
+      #
+      # Default: `false`
+      attest: false
 ````
 
 <!-- usage:end -->
@@ -229,6 +237,8 @@ jobs:
 |                                         | <!-- textlint-disable --><pre lang="ini">[registry."my-registry.local:5000"]&#13; http = true&#13; insecure = true</pre><!-- textlint-enable -->                                                                                                                                                                                                                                                                                                                                                            |              |             |                                  |
 | **`sign`**                              | Sign built images.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | **false**    | **boolean** | `true`                           |
 |                                         | See [sign-images](../../actions/docker/sign-images/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                              |              |             |                                  |
+| **`attest`**                            | Generate build provenance attestations for built images.                                                                                                                                                                                                                                                                                                                                                                                                                                                    | **false**    | **boolean** | `false`                          |
+|                                         | See [attest-images](../../actions/docker/attest-images/README.md).                                                                                                                                                                                                                                                                                                                                                                                                                                          |              |             |                                  |
 
 <!-- inputs:end -->
 

.github/workflows/docker-build-images.yml

@@ -123,6 +123,13 @@ on: # yamllint disable-line rule:truthy
         type: boolean
         default: true
         required: false
+      attest:
+        description: |
+          Generate build provenance attestations for built images.
+          See [attest-images](../../actions/docker/attest-images/README.md).
+        type: boolean
+        default: false
+        required: false
     secrets:
       oci-registry-password:
         description: |
@@ -461,7 +468,8 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write # Needed for signing images
+      id-token: write # Needed for signing and attesting images
+      attestations: write # Needed for attesting images
     needs: [prepare-variables, build-images]
     runs-on: ${{ fromJson(inputs.runs-on) }}
     outputs:
@@ -542,3 +550,28 @@ jobs:
         with:
           images: ${{ steps.get-images-to-sign.outputs.images-to-sign }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: get-images-to-attest
+        if: inputs.attest
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          BUILT_IMAGES_INPUT: ${{ steps.create-images-manifests.outputs.built-images }}
+        with:
+          script: |
+            const builtImagesInput = process.env.BUILT_IMAGES_INPUT;
+            let builtImages = null;
+            try {
+              builtImages = JSON.parse(builtImagesInput);
+            } catch (error) {
+              throw new Error(`"built-images" input is not a valid JSON: ${error}`);
+            }
+
+            // Get images to attest
+            const imagesToAttest = Object.values(builtImages).map(image => image.images).flat();
+            core.setOutput('images-to-attest', JSON.stringify(imagesToAttest));
+
+      - uses: ./../self-workflow/actions/docker/attest-images
+        if: steps.get-images-to-attest.outputs.images-to-attest
+        with:
+          images: ${{ steps.get-images-to-attest.outputs.images-to-attest }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -39,6 +39,8 @@ _Actions that operate on OCI images across their build, metadata, and lifecycle
 
 #### - [Setup](actions/docker/setup/README.md)
 
+#### - [Attest images](actions/docker/attest-images/README.md)
+
 #### - [Sign images](actions/docker/sign-images/README.md)
 
 ### Helm