Merge pull request #199 from fzipi/add-provenance

feat: add provenance to published image
coreruleset · Feb 13, 2024 · 2f67216 · 2f67216
2 parents 7799007 + ba04827
commit 2f67216
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -68,6 +68,8 @@ jobs:
             ./docker-bake.hcl
           targets: ${{ matrix.target }}
           push: true
+          provenance: true
+          sbom: true
 
       - name: Sign the images with GitHub OIDC Token
         env:
@@ -80,3 +82,4 @@ jobs:
             images+="${tag}@${DIGEST} "
           done
           cosign sign --yes ${images}
+