Disable provenance/SBOM attestations

.github/workflows/build-and-push.yml

@@ -37,14 +37,34 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/${{ matrix.arch }}
-          load: true
+          provenance: false
+          sbom: false
+          outputs: type=docker,oci-mediatypes=false
           tags: |
             fedorapython/fedora-python-tox:${{ matrix.arch }}
             fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}
+      - name: Verify single-platform image
+        run: |
+          # Inspect the manifest
+          manifest=$(docker manifest inspect fedorapython/fedora-python-tox:${{ matrix.arch }})
+
+          # For single-platform images, manifests should be null
+          # For multi-platform or images with attestations, manifests is an array
+          manifests=$(echo "$manifest" | jq '.manifests')
+
+          if [ "$manifests" != "null" ]; then
+            manifest_count=$(echo "$manifests" | jq '. | length')
+            echo "ERROR: Image has a manifest list with $manifest_count entries (expected null for single-platform)!"
+            echo "This usually means attestations are enabled or it's a multi-platform image."
+            echo "$manifests" | jq '.[] | {platform: .platform, digest: .digest, annotations: .annotations}'
+            exit 1
+          fi
+
+          echo "✓ Verified: Image is single-platform (manifests: null)"
       - name: Test local project
         env:
           TOXENV: ${{ matrix.toxenv }}
@@ -75,11 +95,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Push to Dockerhub
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
         with:
           context: .
           platforms: linux/${{ matrix.arch }}
+          provenance: false
+          sbom: false
           push: true
           tags: |
             fedorapython/fedora-python-tox:${{ matrix.arch }}