ci: attach provenance and SBOM attestations to the published image

[kobihikri]

Hi, and thanks for web-check.

.github/workflows/docker.yml publishes the image, but the pushed manifest carries no provenance or SBOM attestation. Someone pulling it cannot check that it was built by this workflow, from this repository, at that tag.

web-check is a tool people self-host to inspect other sites, and the usual reason for self-hosting it rather than using the public instance is not wanting the lookups to go through someone else. That is the same instinct that makes image origin worth being able to check.

The change is two lines on the build step:

          push: true
          provenance: mode=max
          sbom: true

BuildKit attaches both to the image manifest, so they travel with the image. No permissions change is needed — nothing has to gain id-token.

docker buildx imagetools inspect <image>:<tag> --format '{{ json .Provenance }}'

The SBOM is arguably the more useful half here: web-check bundles a wide set of lookup and scanning libraries, and sbom: true makes that inventory readable from the manifest instead of requiring someone to run the container to find out.

Two caveats: mode=max records build args (provenance: true is the smaller option), and attestations add an extra manifest to the index, which the registry handles.

No SLSA level claimed.

Disclosure: I used AI assistance to help spot this and prepare the change, and I read the workflow myself.

[netlify]

✅ Deploy Preview for web-check ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	4d4a94f
🔍 Latest deploy log	https://app.netlify.com/projects/web-check/deploys/6a693a5ca5b3590008f19082
😎 Deploy Preview	https://deploy-preview-326--web-check.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kobihikri]

Correction — I got a fact wrong in this PR, and I would rather flag it myself than let it sit.

I wrote that the pushed manifest "carries no provenance or SBOM attestation". That is half wrong, and the wrong half matters.

Provenance is already there. For public repositories, docker/build-push-action adds provenance attestations with mode=max by default — Docker's documentation states it plainly: "Public repos: provenance attestations with mode=max are automatically added". I checked published images and they do already carry attestation manifests. So the provenance: mode=max line in my diff makes existing behaviour explicit; it does not add anything new.

The SBOM is genuinely new. That part stands — the same page says "SBOM attestations aren't automatically added to the image", and sbom: true is what enables them.

I also wrote in the caveats that provenance: true gives "a smaller record". That is wrong as well: true resolves to max on a public repo, and the smaller setting is provenance: mode=min.

So the honest description of this PR is: it adds an SBOM attestation, and pins the provenance mode explicitly instead of relying on the default. Both are still defensible — an explicit line means the behaviour will not change quietly if the default ever does — but it is a smaller change than my description implied, and you should judge it on that basis rather than on what I originally wrote.

Happy to retitle and rewrite the description accordingly, or to close this if the SBOM alone is not worth the diff to you. Either is fine — just say which and I will act on it.

Apologies for the inaccuracy. It was caught by a maintainer reviewing the same change on another project, and they were right to.

[lissy93]

LGTM, thank you @kobihikri

I'll do a follow-up PR in a moment to add signatures (probably in a similar way I did in Dashy's docker workflow: https://github.com/lissy93/dashy/blob/master/.github/workflows/docker.yml)