From 6618240c61014cc224f7dd29a0381409361617f5 Mon Sep 17 00:00:00 2001
From: Kobi Hikri <kobi.hikri@gmail.com>
Date: Sat, 1 Aug 2026 15:11:55 +0300
Subject: [PATCH] ci: attach provenance and SBOM attestations to the published
 images (#3048)

* ci: attach provenance and SBOM attestations to the published images

* ci: restore trailing newline at end of file
---
 .github/workflows/build-docker-image.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/build-docker-image.yml b/.github/workflows/build-docker-image.yml
index b1a576e8..e00a3c54 100644
--- a/.github/workflows/build-docker-image.yml
+++ b/.github/workflows/build-docker-image.yml
@@ -216,6 +216,8 @@ jobs:
           context: .
           file: ./docker/Dockerfile
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=registry,ref=whyour/qinglong:cache-alpine
@@ -295,6 +297,8 @@ jobs:
           context: .
           file: ./docker/Dockerfile.debian
           push: true
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=registry,ref=whyour/qinglong:cache-debian
@@ -359,6 +363,8 @@ jobs:
           context: .
           file: ./docker/Dockerfile.310
           push: true
+          provenance: mode=max
+          sbom: true
           tags: |
             whyour/qinglong:python3.10
             whyour/qinglong:${{ steps.version.outputs.version }}-python3.10
@@ -425,6 +431,8 @@ jobs:
           context: .
           file: ./docker/Dockerfile.debian310
           push: true
+          provenance: mode=max
+          sbom: true
           tags: |
             whyour/qinglong:debian-python3.10
             whyour/qinglong:${{ steps.version.outputs.version }}-debian-python3.10