fix(release): embed OCI build metadata

.github/workflows/release.yml

@@ -28,14 +28,17 @@ jobs:
           [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
 
   artifacts:
-    needs: [verify, security, tag]
+    needs: [verify, security, tag, image]
     runs-on: ubuntu-latest
     permissions: { contents: write }
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }
       - uses: actions/setup-go@v5
         with: { go-version: "1.25.13", cache: true }
+      - uses: docker/setup-buildx-action@v3
+      - name: Generate source SBOM
+        run: docker run --rm -v "$PWD:/repo" anchore/syft:v1.42.3 dir:/repo -o spdx-json > "$RUNNER_TEMP/platform93-source.spdx.json"
       - id: build-assets
         env:
           GH_TOKEN: ${{ github.token }}
@@ -51,6 +54,20 @@ jobs:
           cp api/openapi/platform93.yaml dist/platform93-openapi.yaml
           cp schemas/events/*.schema.json dist/
           cp deploy/compose/compose.yaml dist/platform93-compose.yaml
+          mv "$RUNNER_TEMP/platform93-source.spdx.json" dist/platform93-source.spdx.json
+          IMAGE="ghcr.io/supaapps/platform93:${GITHUB_REF_NAME#v}"
+          DIGEST="$(docker buildx imagetools inspect "$IMAGE" --format '{{json .Manifest.Digest}}' | tr -d '"')"
+          docker buildx imagetools inspect "$IMAGE" --format '{{json .Provenance}}' > dist/platform93-image-provenance.json
+          docker buildx imagetools inspect "$IMAGE" --format '{{json .SBOM}}' > dist/platform93-image.spdx.json
+          jq -n \
+            --arg image "$IMAGE" \
+            --arg digest "$DIGEST" \
+            --arg reference "ghcr.io/supaapps/platform93@$DIGEST" \
+            --arg revision "$GITHUB_SHA" \
+            --arg signature_identity "https://github.com/supaapps/platform93/.github/workflows/release.yml@refs/tags/$GITHUB_REF_NAME" \
+            --arg oidc_issuer "https://token.actions.githubusercontent.com" \
+            '{image: $image, digest: $digest, reference: $reference, revision: $revision, signature: {identity: $signature_identity, oidc_issuer: $oidc_issuer}, attestations: {sbom: "platform93-image.spdx.json", provenance: "platform93-image-provenance.json"}}' \
+            > dist/platform93-oci.json
           (
             cd dist
             find . -maxdepth 1 -type f ! -name SHA256SUMS -print0 | sort -z | xargs -0 sha256sum > "$RUNNER_TEMP/platform93-SHA256SUMS"
@@ -89,6 +106,11 @@ jobs:
     permissions: { contents: read, packages: write, id-token: write, attestations: write }
     steps:
       - uses: actions/checkout@v4
+      - id: build-info
+        run: |
+          BUILD_DATE="$(git show -s --format=%cI "$GITHUB_SHA")"
+          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+          echo "date=$BUILD_DATE" >> "$GITHUB_OUTPUT"
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
@@ -121,8 +143,17 @@ jobs:
           push: true
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.build-info.outputs.version }}
+            COMMIT=${{ github.sha }}
+            BUILD_DATE=${{ steps.build-info.outputs.date }}
           provenance: true
           sbom: true
+      - name: Verify image build metadata
+        run: |
+          IMAGE="ghcr.io/supaapps/platform93:${GITHUB_REF_NAME#v}"
+          EXPECTED="Platform93 ${{ steps.build-info.outputs.version }} (${GITHUB_SHA}, ${{ steps.build-info.outputs.date }})"
+          test "$(docker run --rm "$IMAGE" version)" = "$EXPECTED"
       - uses: sigstore/cosign-installer@v3
       - run: |
           IMAGE="ghcr.io/supaapps/platform93:${GITHUB_REF_NAME#v}"