From 436fbe4ac3428224eeba190dfb0f24a59cb4e14e Mon Sep 17 00:00:00 2001
From: Kobi Hikri <kobi.hikri@gmail.com>
Date: Sat, 8 Aug 2026 19:44:10 +0300
Subject: [PATCH] ci: attach provenance and SBOM attestations to the published
 image (#1775)

---
 .github/workflows/docker.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5513b734..2d5e17bd 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -52,6 +52,8 @@ jobs:
         context: .
         platforms: linux/amd64,linux/arm64
         push: ${{ github.event_name != 'pull_request' }}
+        provenance: mode=max
+        sbom: true
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
         cache-from: type=gha