How to perform provenance attestation on these images ?

Hello,

We are using these images as the base image, we patch and harden a bit and rebuild whenever there is a new release. However we would like to add attestation validation of provenance, are these images being generated with provenance information and sbom so we can validate it when updating our own images ?

lets say something simple with Github Actions

- name: Build and push
uses: docker/build-push-action@v6
with:
tags: "${{ vars.DOCKER_USER }}/${{ vars.DOCKER_IMAGENAME}}:${{ github.ref_name }}"
# For pull requests, export results to the build cache.
# Otherwise, push to a registry.
outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry' }}
**provenance: mode=max
sbom: true**

No repository file or test is named. Start by reviewing the image build workflow described in the issue and the provenance and SBOM settings in docker/build-push-action; done means documenting whether the published images include attestations and how consumers can validate them.

Written by the indexing model from the issue text.