build(ci): generate artifact attestation to GitHub Container Registry

.github/workflows/release.yml

@@ -8,14 +8,16 @@ on:
 
 env:
   DOCS_URL: https://mogeko.github.io/docker-vlmcsd/vlmcsd.8.pdf
-  IMAGE: vlmcsd
+  IMAGE_NAME: vlmcsd
 
 jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
-      packages: write
+      id-token: write
       contents: read
+      attestations: write
+      packages: write
     steps:
       - uses: actions/[email protected]
       - name: Log in to Docker Hub
@@ -35,15 +37,15 @@ jobs:
         uses: docker/[email protected]
         with:
           images: |
-            docker.io/${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE }}
-            ghcr.io/${{ github.actor }}/${{ env.IMAGE }}
+            docker.io/${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}
+            ghcr.io/${{ github.actor }}/${{ env.IMAGE_NAME }}
           tags: |
             type=edge,branch=master,enable={{is_default_branch}}
             type=ref,event=tag,enable=true
             type=sha,prefix=sha-,format=short,enable=true
           labels: |
             org.opencontainers.image.documentation=${{ env.DOCS_URL }}
-            org.opencontainers.image.title=${{ env.IMAGE }}
+            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.vendor=${{ github.actor }}
       - name: Setup QEMU
         uses: docker/[email protected]
@@ -62,9 +64,16 @@ jobs:
           extra-args: --squash
       - name: Push to Container registry
         uses: redhat-actions/[email protected]
+        id: deploy
         with:
           image: ${{ steps.build-image.outputs.image }}
           tags: ${{ steps.build-image.outputs.tags }}
+      - name: Generate artifact attestation to GitHub Container Registry
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ghcr.io/${{ github.actor }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.deploy.outputs.digest }}
+          push-to-registry: true
 
   man-page:
     runs-on: ubuntu-latest