use cosign

Author: st3penta

.github/workflows/build-attest.yml

@@ -62,24 +62,34 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+
       - name: Generate SBOM for container image
         uses: anchore/sbom-action@v0
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}
           output-file: build-sample-sbom.spdx.json
           artifact-name: "build-sample-sbom.spdx.json"
 
-      - name: Generate build provenance attestation
-        uses: actions/attest-build-provenance@v3
-        with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
+      - name: Sign container image with Cosign
+        run: |
+          cosign sign --yes \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}
 
-      - name: Generate SBOM attestation
-        uses: actions/attest-sbom@v2
-        with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          subject-digest: ${{ steps.push.outputs.digest }}
-          sbom-path: "build-sample-sbom.spdx.json"
-          push-to-registry: true
+      - name: Attest SBOM with Cosign
+        run: |
+          cosign attest --yes \
+            --predicate build-sample-sbom.spdx.json \
+            --type spdx \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}
+
+      - name: Generate and attest SLSA provenance with Cosign
+        run: |
+          cosign attest --yes \
+            --predicate <(cosign generate-slsa-provenance \
+              --repo ${{ github.repository }} \
+              --run-id ${{ github.run_id }} \
+              --sha ${{ github.sha }}) \
+            --type slsaprovenance \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}