feat: generate SLSA provenance

Author: dervoeti

.github/workflows/build_push_dev.yml

@@ -16,6 +16,8 @@ jobs:
       packages: write
       attestations: write
       id-token: write
+    outputs:
+      digest: ${{ steps.build-and-push-backend.outputs.digest }}
     steps:
       -
         name: Checkout
@@ -50,6 +52,9 @@ jobs:
           file: ./docker/backend/prod/django/Dockerfile
           platforms: linux/amd64
           push: true
+          # Disable buildkit attestations so the pushed reference is the image
+          # manifest digest (not an index), which the SLSA generator requires.
+          provenance: false
           tags: oci.stackable.tech/stackable/secobserve-backend:dev
           build-args: |
             CREATED=${{ env.CREATED }}
@@ -59,13 +64,31 @@ jobs:
         name: Sign the published backend image
         run: cosign sign -y oci.stackable.tech/stackable/secobserve-backend@${{ steps.build-and-push-backend.outputs.digest }}
 
+  provenance_backend_dev:
+    needs: [docker_backend_dev]
+    permissions:
+      actions: read # detect the build workflow that generated the image
+      id-token: write # mint the OIDC token for keyless signing
+      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
+    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the
+    # reusable workflow cannot verify its own provenance.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      image: oci.stackable.tech/stackable/secobserve-backend
+      digest: ${{ needs.docker_backend_dev.outputs.digest }}
+      registry-username: robot$stackable+github-action-build
+    secrets:
+      registry-password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}
+
   docker_frontend_dev:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
       attestations: write
       id-token: write
+    outputs:
+      digest: ${{ steps.build-and-push-frontend.outputs.digest }}
     steps:
       -
         name: Checkout
@@ -99,6 +122,9 @@ jobs:
           file: ./docker/frontend/prod/Dockerfile
           platforms: linux/amd64
           push: true
+          # Disable buildkit attestations so the pushed reference is the image
+          # manifest digest (not an index), which the SLSA generator requires.
+          provenance: false
           tags: oci.stackable.tech/stackable/secobserve-frontend:dev
           build-args: |
             CREATED=${{ env.CREATED }}
@@ -107,3 +133,19 @@ jobs:
       -
         name: Sign the published frontend image
         run: cosign sign -y oci.stackable.tech/stackable/secobserve-frontend@${{ steps.build-and-push-frontend.outputs.digest }}
+
+  provenance_frontend_dev:
+    needs: [docker_frontend_dev]
+    permissions:
+      actions: read # detect the build workflow that generated the image
+      id-token: write # mint the OIDC token for keyless signing
+      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
+    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the
+    # reusable workflow cannot verify its own provenance.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      image: oci.stackable.tech/stackable/secobserve-frontend
+      digest: ${{ needs.docker_frontend_dev.outputs.digest }}
+      registry-username: robot$stackable+github-action-build
+    secrets:
+      registry-password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}