fix(ci): publish image attestations

Author: seebeen

.github/workflows/docker_build.yml

@@ -58,8 +58,8 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
-          sbom: false
+          provenance: mode=max
+          sbom: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
 

Makefile

@@ -5,7 +5,7 @@ PLATFORMS     ?= linux/amd64,linux/386,linux/arm/v5
 ROOT_PASSWORD ?= root
 PORT          ?= 3306
 
-.PHONY: build build-all run shell structure smoke smoke-all push clean help
+.PHONY: build build-all run shell structure smoke smoke-all publish-check push clean help
 
 build: ## Build the selected platform as :latest and :$(VERSION)
 	docker build --platform=$(PLATFORM) \
@@ -39,8 +39,12 @@ smoke-all: ## Build and smoke-test every release platform
 		IMAGE="$$tag" PLATFORM="$$platform" SKIP_BUILD=1 ./tests/smoke.sh; \
 	done
 
+publish-check: ## Verify release attestations and Docker Hub README publishing
+	./tests/publishing-workflow.sh
+
 push: ## Build and publish the release platform index
-	docker buildx build --push --platform=$(PLATFORMS) \
+	docker buildx build --push --provenance=mode=max --sbom=true \
+		--platform=$(PLATFORMS) \
 		-t $(IMAGE):latest -t $(IMAGE):$(VERSION) .
 
 clean: ## Remove local development images without prompting

README.md

@@ -171,6 +171,7 @@ make build-all   # Build all release platforms into the Buildx cache
 make structure   # Verify package, config, and image cleanup
 make smoke       # Verify initialization, TCP auth, init files, and persistence
 make smoke-all   # Attempt the lifecycle smoke test on every release platform
+make publish-check # Verify attestation and Docker Hub README publishing settings
 make run         # Run the selected image locally
 make shell       # Open Bash in the selected image
 ```
@@ -180,6 +181,20 @@ Multi-platform targets require a Buildx builder with the corresponding QEMU
 handlers. `make smoke-all` fails honestly when the host emulator cannot run an
 architecture's MySQL bootstrap; this is a known possibility for `arm/v5`.
 
+## Supply-chain metadata
+
+Published images include max-level SLSA provenance and an SPDX SBOM for every
+platform. BuildKit attaches both attestations to the multi-platform image index,
+so they can be inspected from Docker Hub without pulling every image:
+
+```bash
+docker buildx imagetools inspect oblakstudio/mysql50:latest
+```
+
+The release workflow also publishes this README and its short description to
+the `oblakstudio/mysql50` Docker Hub repository after every successful image
+push.
+
 ## Releases
 
 Pushes to `master` run semantic-release using Conventional Commits. A published

tests/publishing-workflow.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+WORKFLOW=".github/workflows/docker_build.yml"
+
+build_inputs="$(awk '
+    /^[[:space:]]*uses: docker\/build-push-action@v6$/ { in_step = 1; next }
+    in_step && /^      - name:/ { exit }
+    in_step { print }
+' "$WORKFLOW")"
+
+grep -Eq '^[[:space:]]*push:[[:space:]]*true$' <<<"$build_inputs"
+grep -Eq '^[[:space:]]*platforms:[[:space:]]*linux/amd64,linux/386,linux/arm/v5$' <<<"$build_inputs"
+grep -Eq '^[[:space:]]*provenance:[[:space:]]*mode=max$' <<<"$build_inputs"
+grep -Eq '^[[:space:]]*sbom:[[:space:]]*true$' <<<"$build_inputs"
+
+if grep -Eq '^[[:space:]]*(provenance|sbom):[[:space:]]*false$' "$WORKFLOW"; then
+    echo "publishing workflow disables attestations" >&2
+    exit 1
+fi
+
+grep -Fq 'uses: peter-evans/dockerhub-description@v4' "$WORKFLOW"
+grep -Fq 'repository: ${{ env.REGISTRY_IMAGE }}' "$WORKFLOW"
+grep -Fq 'readme-filepath: ./README.md' "$WORKFLOW"
+grep -Fq 'SLSA provenance' README.md
+grep -Fq 'SPDX SBOM' README.md
+grep -Fq 'make publish-check' README.md
+
+make_push="$(awk '
+    /^push:/ { in_target = 1 }
+    in_target && /^clean:/ { exit }
+    in_target { print }
+' Makefile)"
+grep -Fq -- '--provenance=mode=max' <<<"$make_push"
+grep -Fq -- '--sbom=true' <<<"$make_push"
+
+echo "publishing workflow test passed"