ci: add attestation to container images and SBOMs (#1789)

Add in-toto attestation to base image ci workflows, for both
SBOMs and images themselves upon build and push. Allow necessary
permissions to attest (attestations, packages) on these workflows.

Signed-off-by: Arthur Savage <[email protected]>

.github/workflows/image.yml

@@ -21,6 +21,8 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      attestations: write
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -96,6 +98,14 @@ jobs:
         run: |
           cosign sign -y quay.io/sustainable_computing_io/${{matrix.IMAGE_NAME}}:${{matrix.LABEL}}@${{ steps.build-push-image.outputs.digest }}
 
+      - name: Generate image attestation
+        if: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch')}}
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: quay.io/sustainable_computing_io/${{matrix.IMAGE_NAME}}
+          subject-digest: ${{ steps.build-push-image.outputs.digest }}
+          push-to-registry: ${{ inputs.pushImage }}
+
       - name: Generate SBOM
         uses: anchore/[email protected]
         with:
@@ -110,3 +120,12 @@ jobs:
           name: sbom-${{matrix.IMAGE_NAME}}-${{matrix.LABEL}}.spdx.json
           path: ./sbom-${{matrix.IMAGE_NAME}}-${{matrix.LABEL}}.spdx.json
           retention-days: 1
+
+      - name: Generate SBOM attestation
+        uses: actions/attest-sbom@v1
+        if: ${{ inputs.pushImage }}
+        with:
+          subject-name: quay.io/sustainable_computing_io/${{matrix.IMAGE_NAME}}
+          subject-digest: ${{ steps.build-push-image.outputs.digest }}
+          sbom-path: ./sbom-${{matrix.IMAGE_NAME}}-${{matrix.LABEL}}.spdx.json
+          push-to-registry: ${{ inputs.pushImage }}