ci(package): upload Docker image with provenance

Signed-off-by: Fernando Fernández <[email protected]>

.github/workflows/__package.yml

@@ -282,7 +282,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.JF_BOT_TOKEN }}
 
-      - name: Create multiplatform image ${{ inputs.push && 'and push 🛠️⬆️' || '🛠️' }} 
+      - name: Create multiplatform image and push 🛠️⬆️
         uses: docker/[email protected]
         id: image
         with:
@@ -306,3 +306,17 @@ jobs:
         with:
           name: |
             buildx-*
+
+      - name: Create provenance attestation (ghcr.io) 🔏
+        uses: actions/[email protected]
+        with:
+          subject-name: ghcr.io/${{ env.REGISTRY_IMAGE }}
+          subject-digest: ${{ steps.image.outputs.digest }}
+          push-to-registry: true
+
+      - name: Create provenance attestation (docker.io) 🔏
+        uses: actions/[email protected]
+        with:
+          subject-name: docker.io/${{ env.REGISTRY_IMAGE }}
+          subject-digest: ${{ steps.image.outputs.digest }}
+          push-to-registry: true