feat(container): ship an SBOM and provenance with the published images (#12352)

.github/workflows/api-container-build-push.yml

@@ -162,6 +162,9 @@ jobs:
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}

.github/workflows/mcp-container-build-push.yml

@@ -144,6 +144,9 @@ jobs:
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}

.github/workflows/sdk-container-build-push.yml

@@ -200,6 +200,9 @@ jobs:
           context: .
           file: ${{ env.DOCKERFILE_PATH }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.latest_tag }}-${{ matrix.arch }}

.github/workflows/ui-container-build-push.yml

@@ -147,6 +147,9 @@ jobs:
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}

api/changelog.d/api-sbom-attestations.added.md

@@ -0,0 +1 @@
+Container images now ship an SBOM and build provenance as OCI attestations

mcp_server/changelog.d/mcp-sbom-attestations.added.md

@@ -0,0 +1 @@
+Container images now ship an SBOM and build provenance as OCI attestations

prowler/changelog.d/sbom-attestations.added.md

@@ -0,0 +1 @@
+Container images now ship an SBOM and build provenance as OCI attestations

ui/changelog.d/ui-sbom-attestations.added.md

@@ -0,0 +1 @@
+Container images now ship an SBOM and build provenance as OCI attestations