ci: opt-in sbom and provenance

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>

.github/workflows/ci.yaml

@@ -15,6 +15,8 @@ on:
 
 env:
   DOCKERHUB_SLUG: docker/buildkit-syft-scanner
+  BUILDX_VERSION: v0.10.0-rc2
+  BUILDKIT_IMAGE: moby/buildkit:v0.11.0-rc3
 
 jobs:
   build:
@@ -48,6 +50,10 @@ jobs:
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          buildkitd-flags: --debug
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
@@ -64,3 +70,6 @@ jobs:
             ${{ steps.meta.outputs.bake-file }}
           targets: image
           push: ${{ github.event_name != 'pull_request' }}
+          set: |
+            *.attest=type=sbom
+            *.attest=type=provenance,mode=max,builder-id=https://github.com/${{ env.GITHUB_REPOSITORY }}/actions/runs/${{ env.GITHUB_RUN_ID }}

Dockerfile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-#syntax=docker/dockerfile:1
+# syntax=docker/dockerfile-upstream:master
 
 ARG GO_VERSION="1.19"
 ARG ALPINE_VERSION="3.17"