sign-and-attest composite (Step C-1 of pin-reduction)

[Cre-eD]

What

A composite action that encapsulates the four-step attestation pipeline that ships in every SC release workflow today (push.yaml, branch-preview.yaml, build-staging.yml):

1. CycloneDX SBOM generation via syft scan registry:<image-ref>
2. cosign keyless sign (Fulcio + Rekor)
3. cosign attest the SBOM (--type cyclonedx, registry slot)
4. SLSA Build L3 provenance via actions/attest-build-provenance@v4 (GitHub attestation API slot, deliberately NOT registry — see SC SECURITY.md for the cross-attestation contract)

# Consumer-side AFTER this lands (replaces ~50 lines per image)
- name: Build and push
  id: build
  uses: docker/build-push-action@<sha>
  with: { ... }

- name: Sign + attest
  uses: simple-container-com/actions/sign-and-attest@<sha>
  with:
    image-ref: ${{ env.IMAGE_REPO }}@${{ steps.build.outputs.digest }}
    image-name: caddy
    subject-name: ${{ env.IMAGE_REPO }}
    subject-digest: ${{ steps.build.outputs.digest }}
    soft-fail: 'true'  # default during Phase 2 bake-in

Per-step outcomes (sbom-outcome, sign-outcome, attest-outcome, slsa-outcome) are surfaced as outputs so the consumer can aggregate them into a single ::warning:: summary the same way push.yaml does today.

Step C in context

Step	What	Status
A	setup-sc-tooling composite	PR #12 (open)
B	install-attest-tools composite (promoted from api-local)	PR #12 (open)
C-1	sign-and-attest composite (this PR)	here
C-2	sc-image-release.yml reusable workflow that wraps setup + docker/build-push-action + sign-and-attest + notify-telegram into a single-call build-and-publish flow	Next session

Tests — real integration

.github/workflows/self-test-sign-and-attest.yml is not a static check. It:

1. Builds a tiny alpine-based image inline (Dockerfile generated in the step)
2. Pushes to ghcr.io/simple-container-com/actions/sign-and-attest-test:run-<id>-attempt-<n>
3. Invokes the composite against the fresh digest
4. Runs the three verification commands a real consumer would run:
   • cosign verify
   • cosign verify-attestation --type cyclonedx
   • gh attestation verify --repo simple-container-com/actions
     …all against the identity regex ^https://github\.com/simple-container-com/actions/.
5. Asserts all four composite outputs are success and the SBOM file exists on disk

Uses soft-fail: false so a transient sigstore-public outage surfaces as clear CI failure. Wall-clock ~2 min per run.

Caller responsibilities (documented in the composite description)

• Set permissions: on the calling job:

  permissions:
    id-token: write       # OIDC for cosign keyless + attest-build-provenance
    attestations: write   # actions/attest-build-provenance API

• Pass image-ref WITH digest (@sha256:…). Tag-only references are TOCTOU-unsafe.
• Set install-tools: false if the calling job already invoked install-attest-tools (idempotent, but saves ~10s).

Verification

• actionlint clean
• shellcheck clean
• bash semgrep-scan/run-tests.sh — 0 findings full-repo
• Self-test workflow passes on the PR (wall-clock ~2 min)

Follow-up after merge

• New api PR refactors push.yaml / branch-preview.yaml / build-staging.yml to use sign-and-attest@<sha> instead of the inline 5-step block per image. Replaces ~50 LOC per image with ~7.
• Step C-2 (sc-image-release.yml) tracked in HARDENING.md for the next session.

[github-actions]

Security Scan Results

Repository: actions | Commit: 6063f2c

Check	Status	Details
✅ Secret Scan	Pass	No secrets detected
⏩ Dependencies	Skipped	-

Scanned at 2026-05-16 21:03 UTC

[github-actions]

Semgrep Scan Results

Repository: actions | Commit: 6063f2c

Check	Status	Details
✅ Semgrep	Pass	0 total findings (no error/warning)

Scanned at 2026-05-16 21:03 UTC