Add setup-sc-tooling + install-attest-tools composites (Step A+B of pin-reduction)

install-attest-tools/action.yml

@@ -0,0 +1,45 @@
+name: 'Install attestation tools'
+description: |
+  Install cosign + syft with single-source SHA pins for use across SC
+  release pipelines (image signing, CycloneDX SBOM generation, SLSA
+  attestation verification). Provenance verification uses the `gh` CLI
+  (preinstalled on GitHub-hosted runners) against the GitHub-native
+  attestation API, so no separate `slsa-verifier` install is required —
+  this composite asserts `gh` is present and fails fast if it's missing.
+
+  Originally lived at `simple-container-com/api/.github/actions/install-attest-tools`;
+  promoted to the shared `simple-container-com/actions` ruleset for
+  cross-consumer reuse (every consumer that publishes signed artifacts
+  needs the same toolchain at the same pinned versions).
+
+inputs:
+  cosign-version:
+    description: 'Cosign CLI release tag to install (e.g. `v2.4.1`).'
+    required: false
+    default: 'v2.4.1'
+  syft-version:
+    description: 'Syft CLI release tag to install (e.g. `v1.16.0`).'
+    required: false
+    default: 'v1.16.0'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install cosign
+      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+      with:
+        cosign-release: ${{ inputs.cosign-version }}
+
+    - name: Install syft
+      uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+      with:
+        syft-version: ${{ inputs.syft-version }}
+
+    - name: Verify gh CLI is available (for `gh attestation verify`)
+      shell: bash
+      run: |
+        if ! command -v gh >/dev/null 2>&1; then
+          echo "::error::gh CLI not found on PATH — required for 'gh attestation verify' provenance checks. Install gh or switch to a runner image that ships it." >&2
+          exit 1
+        fi
+        gh --version | head -n 1

setup-sc-tooling/action.yml

@@ -0,0 +1,69 @@
+name: 'Setup SC Tooling'
+description: |
+  Install Simple Container CLI (`sc`) and/or Welder in one step. Both
+  install scripts are invoked directly (not via the `install-sc` /
+  `install-welder` composites) to avoid GitHub Actions' restriction
+  against composite-to-composite `uses:` references that interpolate
+  the parent ref — this keeps the composite self-contained at whatever
+  SHA the consumer pinned.
+
+inputs:
+  install-sc:
+    description: 'Install the sc CLI (`true` / `false`).'
+    required: false
+    default: 'true'
+  install-welder:
+    description: 'Install Welder (`true` / `false`).'
+    required: false
+    default: 'true'
+  sc-version:
+    description: 'sc CLI version (e.g. `2026.4.12` or a `-preview.<sha>` tag). Empty → latest.'
+    required: false
+    default: ''
+  sc-sha256:
+    description: 'OPTIONAL hex SHA256 of the sc tarball. When set, the download is verified before extraction.'
+    required: false
+    default: ''
+  welder-version:
+    description: 'Welder version (e.g. `2026.4.12`). Empty → latest.'
+    required: false
+    default: ''
+  welder-sha256:
+    description: 'OPTIONAL hex SHA256 of the Welder tarball.'
+    required: false
+    default: ''
+
+outputs:
+  sc-version:
+    description: 'The sc version that was installed (resolved from input or `latest`).'
+    value: ${{ steps.install_sc.outputs.version }}
+  sc-binary:
+    description: 'Absolute path to the installed `sc` binary.'
+    value: ${{ steps.install_sc.outputs.binary }}
+  welder-version:
+    description: 'The Welder version that was installed.'
+    value: ${{ steps.install_welder.outputs.version }}
+  welder-binary:
+    description: 'Absolute path to the installed `welder` binary.'
+    value: ${{ steps.install_welder.outputs.binary }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install sc
+      id: install_sc
+      if: inputs.install-sc == 'true'
+      shell: bash
+      env:
+        SC_VERSION: ${{ inputs.sc-version }}
+        SC_SHA256: ${{ inputs.sc-sha256 }}
+      run: ${{ github.action_path }}/../install-sc/install.sh
+
+    - name: Install Welder
+      id: install_welder
+      if: inputs.install-welder == 'true'
+      shell: bash
+      env:
+        WELDER_VERSION: ${{ inputs.welder-version }}
+        WELDER_SHA256: ${{ inputs.welder-sha256 }}
+      run: ${{ github.action_path }}/../install-welder/install.sh