feat: add attestation to installer

.github/workflows/docker.yml

@@ -23,6 +23,10 @@ jobs:
  fail-fast: false
  matrix:
  version: ["18.04", "20.04", "22.04", "24.04"]
+ permissions:
+ contents: read # for code access
+ attestations: write # for actions/attest-build-provenance
+ id-token: write # for actions/attest-build-provenance
  steps:
  - name: Checkout
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
@@ -52,6 +56,18 @@ jobs:
  - name: Run brew test-bot --only-setup
  run: docker run --rm brew brew test-bot --only-setup
 
+ - name: Generate image digest
+ id: digest
+ run: echo "digest=$(docker inspect --format='{{index .RepoDigests 0}}' brew)" >> "$GITHUB_OUTPUT"
+
+ - name: Generate build provenance
+ uses: actions/[email protected]
+ id: attest
+ with:
+ subject-name: ghcr.io/homebrew/ubuntu${{matrix.version}}
+ subject-digest: ${{ steps.digest.outputs.digest }}
+ push-to-registry: ${{ startsWith(github.ref, 'refs/tags/') }}
+
  - name: Deploy the tagged Docker image to GitHub Packages
  if: startsWith(github.ref, 'refs/tags/')
  run: |

.github/workflows/pkg-installer.yml

@@ -19,6 +19,10 @@ jobs:
  build:
  if: github.repository_owner == 'Homebrew'
  runs-on: macos-latest
+ permissions:
+ contents: read # for code access
+ attestations: write # for actions/attest-build-provenance
+ id-token: write # for actions/attest-build-provenance
  outputs:
  installer_path: "Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg"
  env:
@@ -119,6 +123,11 @@ jobs:
  security delete-keychain "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
  fi
 
+ - name: Generate build provenance
+ uses: actions/[email protected]
+ with:
+ subject-path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
+
  - name: Upload installer to GitHub Actions
  uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4
  with: