feat(ci): add attestaion step to build and container

.github/workflows/build.yml

@@ -24,20 +24,20 @@ on:
         type: string
         default: Debug
 
-permissions: { }
-
 jobs:
   build:
     name: Build (${{ matrix.artifact-name }})
 
-    environment: ${{ inputs.environment || '' }}
+    environment: ${{ inputs.environment }}
 
     permissions:
       contents: read
       # Required for Azure Trusted Signing
       id-token: write
       # Required for vcpkg binary cache
       packages: write
+      # rq for GitHub Artifact Attestations
+      attestations: write
 
     strategy:
       fail-fast: false
@@ -186,3 +186,11 @@ jobs:
           azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
           azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Attest Release Packages
+        if: ${{ steps.setup-dependencies.outputs.build-type == 'Release' }}
+        # Pinning to actions/attest-build-provenance@v2.2.3
+        # in case Dependabot update it.
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
+        with:
+          subject-path: ${{ github.workspace }}/**/${{ matrix.artifact-name }}

.github/workflows/container.yml

@@ -10,8 +10,6 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions: { }
-
 env:
   REGISTRY: ghcr.io
 
@@ -22,6 +20,10 @@ jobs:
     permissions:
       contents: read
       packages: write
+      # attestations rq
+      id-token: write
+      attestations: write
+      artifact-metadata: write
 
     outputs:
       image-name: ${{ steps.image-name.outputs.image-name }}
@@ -105,6 +107,15 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+      - name: Attest Devcontainer Image
+        if: ${{ github.event_name != 'pull_request' }}
+        # Pinning to actions/attest-build-provenance@v2.2.3
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
+        with:
+          subject-name: ${{ steps.image-name.outputs.image-name }}
+          subject-digest: ${{ steps.id-push-image.outputs.digest }}
+          push-to-registry: true
+
   manifest:
     name: Create manifest
 
@@ -114,6 +125,10 @@ jobs:
     permissions:
       contents: read
       packages: write
+      # attestation rq
+      id-token: write
+      attestations: write
+      # artifact-metadata: write
 
     runs-on: ubuntu-24.04
 
@@ -172,3 +187,10 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ github.token }}
           tls-verify: true
+
+      - name: Attest Multi-Arch Manifest
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
+        with:
+          subject-name: ${{ needs.build.outputs.image-name }}
+          subject-digest: ${{ steps.push-manifest.outputs.digest }}
+          push-to-registry: true