Generate proxy image attestations

[JamieMagee]

What are you trying to accomplish?

Publish GitHub build provenance for proxy images so consumers can verify their source. Push by digest, store attestations in GitHub and GHCR, then publish the image and Git tags.

Anything you want to highlight for special attention from reviewers?

Attestation failure stops tag publication. This replaces the shell publisher with pinned Docker actions and actions/attest. Local build/test behavior, platform support and tag formats stay unchanged.

How will you know you've accomplished your goal?

YAML lint and shell checks passed. A local registry exercise preserved the image digest under both release tags. Live OIDC issuance still needs an authorized main-branch run. The complete test suite was not run.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Production OIDC issuance and registry attestation still require validation through an authorized main-branch run.

Review tier: Balanced
Findings: None

What changed in this PR

Adds verifiable build provenance to GHCR image publication.

Changes:

• Publishes images by digest and attests them before tagging.
• Replaces the shell publisher with pinned actions.
• Documents verification and tests workflow invariants.

File	Description
.github/​workflows/​ghcr.yml	Implements digest-based build, attestation, and tagging.
ghcr_workflow_test.go	Tests publication ordering and security constraints.
README.md	Documents provenance verification.
script/​cibuild-publish-ghcr	Removes the superseded publisher.
script/​_common	Removes the unused branch constant.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.