ci: attach provenance and SBOM attestations to the published image

[kobihikri]

Hi, and thanks for ACE-Step.

.github/workflows/container.yml publishes the image, but the pushed manifest carries no provenance or SBOM attestation. Someone pulling it cannot check that it was built by this workflow, from this repository, at that tag.

The SBOM half is the useful one here: the image bundles a large model and audio stack, and publishing that inventory means it can be assessed without running the container first.

The change is two lines on the build step:

          push: ...
          provenance: mode=max
          sbom: true

BuildKit attaches both to the image manifest, so they travel with the image. No permissions change is needed — nothing has to gain id-token, and your tag and cache configuration are untouched.

docker buildx imagetools inspect <image>:<tag> --format '{{ json .Provenance }}'

Two caveats worth stating: mode=max records the full build including build arguments, so provenance: true is the smaller option if any have ever been sensitive; and attestations add an extra manifest to the index, which the registry supports.

No SLSA level claimed — the attestation is what BuildKit produces.

Disclosure: I used AI assistance to help spot this and prepare the change, and I read the workflow myself.

Summary by CodeRabbit

• Chores
  • Updated the Docker image build to include enhanced build provenance information.
  • Enabled generation of Software Bill of Materials (SBOM) metadata for produced images.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9216d567-372d-45af-9d12-6c94a4880b15

📥 Commits

Reviewing files that changed from the base of the PR and between 3ca195e and d36a253.

📒 Files selected for processing (1)

• .github/workflows/container.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/container.yml

---

📝 Walkthrough

Walkthrough

The container workflow enables maximum Docker provenance generation and SBOM output during image builds, while preserving the existing linux/amd64 platform setting.

Changes

Container image metadata

Layer / File(s)	Summary
Docker build metadata .github/workflows/container.yml	The image build and push step enables provenance: mode=max and sbom: true.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

I’m a rabbit with metadata bright,
Packing image trails in the light.
SBOMs in my pack,
Provenance on track—
The container hops cleanly tonight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding provenance and SBOM attestations to the published image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kobihikri]

Correction — I got a fact wrong in this PR, and I would rather flag it myself than let it sit.

I wrote that the pushed manifest "carries no provenance or SBOM attestation". That is half wrong, and the wrong half matters.

Provenance is already there. For public repositories, docker/build-push-action adds provenance attestations with mode=max by default — Docker's documentation states it plainly: "Public repos: provenance attestations with mode=max are automatically added". I checked published images and they do already carry attestation manifests. So the provenance: mode=max line in my diff makes existing behaviour explicit; it does not add anything new.

The SBOM is genuinely new. That part stands — the same page says "SBOM attestations aren't automatically added to the image", and sbom: true is what enables them.

I also wrote in the caveats that provenance: true gives "a smaller record". That is wrong as well: true resolves to max on a public repo, and the smaller setting is provenance: mode=min.

So the honest description of this PR is: it adds an SBOM attestation, and pins the provenance mode explicitly instead of relying on the default. Both are still defensible — an explicit line means the behaviour will not change quietly if the default ever does — but it is a smaller change than my description implied, and you should judge it on that basis rather than on what I originally wrote.

Happy to retitle and rewrite the description accordingly, or to close this if the SBOM alone is not worth the diff to you. Either is fine — just say which and I will act on it.

Apologies for the inaccuracy. It was caught by a maintainer reviewing the same change on another project, and they were right to.