From 38d1b80954ea102ae32a7e8000404dda9fc69d72 Mon Sep 17 00:00:00 2001
From: Nawwar Elnarsh <nawwar@supaapps.com>
Date: Sun, 16 Aug 2026 18:15:00 +0200
Subject: [PATCH 1/2] fix(release): embed OCI build metadata

---
 .github/workflows/release.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fdee4cc..8fcadf0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,6 +89,11 @@ jobs:
     permissions: { contents: read, packages: write, id-token: write, attestations: write }
     steps:
       - uses: actions/checkout@v4
+      - id: build-info
+        run: |
+          BUILD_DATE="$(git show -s --format=%cI "$GITHUB_SHA")"
+          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+          echo "date=$BUILD_DATE" >> "$GITHUB_OUTPUT"
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
@@ -121,8 +126,17 @@ jobs:
           push: true
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.build-info.outputs.version }}
+            COMMIT=${{ github.sha }}
+            BUILD_DATE=${{ steps.build-info.outputs.date }}
           provenance: true
           sbom: true
+      - name: Verify image build metadata
+        run: |
+          IMAGE="ghcr.io/supaapps/platform93:${GITHUB_REF_NAME#v}"
+          EXPECTED="Platform93 ${{ steps.build-info.outputs.version }} (${GITHUB_SHA}, ${{ steps.build-info.outputs.date }})"
+          test "$(docker run --rm "$IMAGE" version)" = "$EXPECTED"
       - uses: sigstore/cosign-installer@v3
       - run: |
           IMAGE="ghcr.io/supaapps/platform93:${GITHUB_REF_NAME#v}"

From a14968223835de628d37dde672826a5cacf54865 Mon Sep 17 00:00:00 2001
From: Nawwar Elnarsh <nawwar@supaapps.com>
Date: Sun, 16 Aug 2026 18:17:00 +0200
Subject: [PATCH 2/2] chore(release): attach supply-chain metadata

---
 .github/workflows/release.yml | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8fcadf0..2f23603 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
           [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
 
   artifacts:
-    needs: [verify, security, tag]
+    needs: [verify, security, tag, image]
     runs-on: ubuntu-latest
     permissions: { contents: write }
     steps:
@@ -36,6 +36,9 @@ jobs:
         with: { fetch-depth: 0 }
       - uses: actions/setup-go@v5
         with: { go-version: "1.25.13", cache: true }
+      - uses: docker/setup-buildx-action@v3
+      - name: Generate source SBOM
+        run: docker run --rm -v "$PWD:/repo" anchore/syft:v1.42.3 dir:/repo -o spdx-json > "$RUNNER_TEMP/platform93-source.spdx.json"
       - id: build-assets
         env:
           GH_TOKEN: ${{ github.token }}
@@ -51,6 +54,20 @@ jobs:
           cp api/openapi/platform93.yaml dist/platform93-openapi.yaml
           cp schemas/events/*.schema.json dist/
           cp deploy/compose/compose.yaml dist/platform93-compose.yaml
+          mv "$RUNNER_TEMP/platform93-source.spdx.json" dist/platform93-source.spdx.json
+          IMAGE="ghcr.io/supaapps/platform93:${GITHUB_REF_NAME#v}"
+          DIGEST="$(docker buildx imagetools inspect "$IMAGE" --format '{{json .Manifest.Digest}}' | tr -d '"')"
+          docker buildx imagetools inspect "$IMAGE" --format '{{json .Provenance}}' > dist/platform93-image-provenance.json
+          docker buildx imagetools inspect "$IMAGE" --format '{{json .SBOM}}' > dist/platform93-image.spdx.json
+          jq -n \
+            --arg image "$IMAGE" \
+            --arg digest "$DIGEST" \
+            --arg reference "ghcr.io/supaapps/platform93@$DIGEST" \
+            --arg revision "$GITHUB_SHA" \
+            --arg signature_identity "https://github.com/supaapps/platform93/.github/workflows/release.yml@refs/tags/$GITHUB_REF_NAME" \
+            --arg oidc_issuer "https://token.actions.githubusercontent.com" \
+            '{image: $image, digest: $digest, reference: $reference, revision: $revision, signature: {identity: $signature_identity, oidc_issuer: $oidc_issuer}, attestations: {sbom: "platform93-image.spdx.json", provenance: "platform93-image-provenance.json"}}' \
+            > dist/platform93-oci.json
           (
             cd dist
             find . -maxdepth 1 -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/platform93-SHA256SUMS"