ci: SLSA Build L3 provenance and SBOM attestations

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Release workflows sign attestations; changes need an admin's review
+/.github/workflows/ @php/frankenphp-admin
+/.github/actions/ @php/frankenphp-admin

.github/workflows/build-docker.yaml

@@ -0,0 +1,42 @@
+---
+name: Build Docker Images
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    branches:
+      - main
+  push:
+    branches:
+      - main
+    tags:
+      - v*.*.*
+  workflow_dispatch:
+    inputs:
+      #checkov:skip=CKV_GHA_7
+      version:
+        description: "FrankenPHP version"
+        required: false
+        type: string
+  schedule:
+    - cron: "0 4 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  # Attestations are signed by the reusable workflow, which verifiers pin with --signer-workflow (SLSA Build L3)
+  build:
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    uses: ./.github/workflows/docker.yaml
+    with:
+      version: ${{ inputs.version }}
+    secrets:
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} # zizmor: ignore[secrets-outside-env] TODO: drop once super-linter ships zizmor >=1.24.0, then the allowlist in zizmor.yaml takes over

.github/workflows/build-static.yaml

@@ -0,0 +1,42 @@
+---
+name: Build binary releases
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    branches:
+      - main
+  push:
+    branches:
+      - main
+    tags:
+      - v*.*.*
+  workflow_dispatch:
+    inputs:
+      #checkov:skip=CKV_GHA_7
+      version:
+        description: "FrankenPHP version"
+        required: false
+        type: string
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  # Attestations are signed by the reusable workflow, which verifiers pin with --signer-workflow (SLSA Build L3)
+  build:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    uses: ./.github/workflows/static.yaml
+    with:
+      version: ${{ inputs.version }}
+    secrets:
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} # zizmor: ignore[secrets-outside-env] TODO: drop once super-linter ships zizmor >=1.24.0, then the allowlist in zizmor.yaml takes over

.github/workflows/build-windows.yaml

@@ -0,0 +1,40 @@
+---
+name: Build Windows release
+concurrency:
+  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    branches:
+      - main
+  push:
+    branches:
+      - main
+    tags:
+      - v*.*.*
+  workflow_dispatch:
+    inputs:
+      #checkov:skip=CKV_GHA_7
+      version:
+        description: "FrankenPHP version"
+        required: false
+        type: string
+  schedule:
+    - cron: "0 8 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  # Attestations are signed by the reusable workflow, which verifiers pin with --signer-workflow (SLSA Build L3)
+  build:
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    uses: ./.github/workflows/windows.yaml
+    with:
+      version: ${{ inputs.version }}

.github/workflows/docker.yaml

@@ -1,27 +1,15 @@
 ---
 name: Build Docker Images
-concurrency:
-  cancel-in-progress: true
-  group: ${{ github.workflow }}-${{ github.ref }}
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-    branches:
-      - main
-  push:
-    branches:
-      - main
-    tags:
-      - v*.*.*
-  workflow_dispatch:
+  workflow_call:
     inputs:
-      #checkov:skip=CKV_GHA_7
       version:
         description: "FrankenPHP version"
         required: false
         type: string
-  schedule:
-    - cron: "0 4 * * *"
+    secrets:
+      DOCKERHUB_TOKEN:
+        required: false
 permissions:
   contents: read
 env:
@@ -255,3 +243,73 @@ jobs:
           subject-name: docker.io/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.inspect.outputs.digest }}
           push-to-registry: true
+
+  # SBOMs are per platform image: architectures ship different packages
+  sbom:
+    runs-on: ubuntu-24.04
+    needs:
+      - prepare
+      - build
+    if: fromJson(needs.prepare.outputs.push)
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      - name: Prepare
+        id: prepare
+        run: echo "sanitized_platform=${PLATFORM//\//-}" >> "${GITHUB_OUTPUT}"
+        env:
+          PLATFORM: ${{ matrix.platform }}
+      - name: Download builder metadata
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: metadata-builder-${{ matrix.variant }}-${{ steps.prepare.outputs.sanitized_platform }}
+          path: /tmp/metadata/builder
+      - name: Download runner metadata
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: metadata-runner-${{ matrix.variant }}-${{ steps.prepare.outputs.sanitized_platform }}
+          path: /tmp/metadata/runner
+      - name: Login to DockerHub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }} # zizmor: ignore[secrets-outside-env] TODO: drop once super-linter ships zizmor >=1.24.0, then the allowlist in zizmor.yaml takes over
+      - name: Read digests
+        id: digests
+        run: |
+          {
+            echo "builder=sha256:$(ls /tmp/metadata/builder)"
+            echo "runner=sha256:$(ls /tmp/metadata/runner)"
+          } >> "${GITHUB_OUTPUT}"
+      - name: Generate builder SBOM
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          image: docker.io/${{ env.IMAGE_NAME }}@${{ steps.digests.outputs.builder }}
+          output-file: builder.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-name: docker.io/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.digests.outputs.builder }}
+          sbom-path: builder.spdx.json
+          push-to-registry: true
+      - name: Generate runner SBOM
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          image: docker.io/${{ env.IMAGE_NAME }}@${{ steps.digests.outputs.runner }}
+          output-file: runner.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-name: docker.io/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.digests.outputs.runner }}
+          sbom-path: runner.spdx.json
+          push-to-registry: true

.github/workflows/release.yaml

@@ -371,7 +371,7 @@ jobs:
           VERSION: ${{ inputs.version }}
         run: |
           failed=()
-          for wf in static.yaml docker.yaml windows.yaml; do
+          for wf in build-static.yaml build-docker.yaml build-windows.yaml; do
             if ! gh workflow run "${wf}" --repo "${REPO}" --ref "v${VERSION}" -f version="${VERSION}"; then
               failed+=("${wf}")
             fi