Add GitHub artifact attestations to Docker workflow

[shaanmajid]

Adds actions/attest-build-provenance to the Docker build workflow so consumers can verify images were built by CI:

gh attestation verify oci://ghcr.io/j178/prek:latest --repo j178/prek

Similar to #1494 which added attestations for release artifacts.

Reference: astral-sh/uv#8685

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.50%. Comparing base (cc3d76e) to head (aaed56c).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1497   +/-   ##
=======================================
  Coverage   91.50%   91.50%           
=======================================
  Files          87       87           
  Lines       18154    18154           
=======================================
  Hits        16611    16611           
  Misses       1543     1543           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[prek-ci-bot]

📦 Cargo Bloat Comparison

Binary size change: +0.00% (22.5 MiB → 22.5 MiB)

Expand for cargo-bloat output

Head Branch Results

 File  .text    Size           Crate Name
 0.3%   0.8% 77.0KiB           prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6% 59.4KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.6% 56.1KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.5% 43.2KiB            prek prek::run::{{closure}}
 0.2%   0.5% 43.1KiB            prek prek::identify::by_extension::{{closure}}
 0.2%   0.4% 41.5KiB            prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4% 41.0KiB            prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.1%   0.3% 32.0KiB           prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.2% 21.6KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.6KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.0KiB    clap_builder clap_builder::parser::parser::Parser::get_matches_with
 0.1%   0.2% 20.8KiB            prek prek::archive::unzip::{{closure}}
 0.1%   0.2% 20.0KiB cargo_metadata? <cargo_metadata::_::<impl serde_core::de::Deserialize for cargo_metadata::Package>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.3KiB            prek <prek::languages::ruby::ruby::Ruby as prek::languages::LanguageImpl>::install::{{closure}}
 0.1%   0.2% 18.6KiB            ring ring_core_0_17_14__x25519_ge_frombytes_vartime
 0.1%   0.2% 18.2KiB             std core::ptr::drop_in_place<prek::languages::<impl prek::config::Language>::install::{{closure}}>
 0.1%   0.2% 18.1KiB       [Unknown] fe_loose_invert
 0.1%   0.2% 18.1KiB      hyper_util hyper_util::client::legacy::client::Client<C,B>::send_request::{{closure}}
36.8%  91.6%  8.3MiB                 And 20111 smaller methods. Use -n N to show more.
40.2% 100.0%  9.1MiB                 .text section size, the file size is 22.5MiB

Base Branch Results

 File  .text    Size           Crate Name
 0.3%   0.8% 77.0KiB           prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6% 59.4KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.6% 56.1KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.5% 43.2KiB            prek prek::run::{{closure}}
 0.2%   0.5% 43.1KiB            prek prek::identify::by_extension::{{closure}}
 0.2%   0.4% 41.5KiB            prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4% 41.0KiB            prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.1%   0.3% 32.0KiB           prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.2% 21.6KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.6KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.0KiB    clap_builder clap_builder::parser::parser::Parser::get_matches_with
 0.1%   0.2% 20.8KiB            prek prek::archive::unzip::{{closure}}
 0.1%   0.2% 20.0KiB cargo_metadata? <cargo_metadata::_::<impl serde_core::de::Deserialize for cargo_metadata::Package>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.3KiB            prek <prek::languages::ruby::ruby::Ruby as prek::languages::LanguageImpl>::install::{{closure}}
 0.1%   0.2% 18.6KiB            ring ring_core_0_17_14__x25519_ge_frombytes_vartime
 0.1%   0.2% 18.2KiB             std core::ptr::drop_in_place<prek::languages::<impl prek::config::Language>::install::{{closure}}>
 0.1%   0.2% 18.1KiB       [Unknown] fe_loose_invert
 0.1%   0.2% 18.1KiB      hyper_util hyper_util::client::legacy::client::Client<C,B>::send_request::{{closure}}
36.8%  91.6%  8.3MiB                 And 20111 smaller methods. Use -n N to show more.
40.2% 100.0%  9.1MiB                 .text section size, the file size is 22.5MiB

[shaanmajid]

@copilot can i request you big dawg or only j178

[shaanmajid]

@copilot gimme review pretty pls

[j178]

I set up automatic review with copilot, not sure why it didn’t trigger on this PR…

[Copilot]

Pull request overview

This PR adds GitHub artifact attestations to the Docker build workflow, enabling consumers to verify that Docker images were built by CI. This mirrors the functionality added in PR #1494 for release artifacts and follows the pattern from astral-sh/uv#8685.

Changes:

• Added attestations: write and id-token: write permissions to the build-docker job configuration
• Updated the Docker workflow to extract the manifest digest and generate build provenance attestations
• Configured permissions in the release workflow to support attestation generation when calling the Docker build workflow

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
dist-workspace.toml	Added attestations and id-token permissions to the build-docker job configuration
.github/workflows/release.yml	Added attestations and id-token permissions when calling the build-docker workflow
.github/workflows/build-docker.yml	Added steps to export the manifest digest and generate artifact attestations using actions/attest-build-provenance

[shaanmajid]

I set up automatic review with copilot, not sure why it didn’t trigger on this PR…

It doesn't like me i guess :(

[j178]

Thank you!