Add SLSA Provenance feature

[Jeroen Knoops (JeroenKnoops)]

This PR will add an extra option to generate a provenance file.

Usage

Add input slsa-provenance: true to generate a provenance file.

Exampe workflow

- name: Build Docker Images
  id: docker
  uses: philips-software/docker-ci-scripts@v3.3.2
  with:
    dockerfile: .
    image-name: image-name-here
    tags: latest 0.1
    slsa-provenance: true
  env:
    DOCKER_USERNAME: ${{ github.actor }}
    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
    DOCKER_REGISTRY: ghcr.io/organization-here
    GITHUB_ORGANIZATION: organization-here

The filename of the provenance file is given as an output. You can use that to upload the provenance file as artifact.

- name: Upload a Build Artifact
  uses: actions/upload-artifact@v2.3.1
  with:
    name: provenance
    path: ${{ steps.docker.outputs.slsa-provenance-file }}
    retention-days: 5

Cosign

We're going to use Cosign to attach the provenance file to the docker image later. There are already parts of this change in this PR. I want to release this feature together with the cosign change, but I like PRs for one specific thing only.
The Cosign installation part is not used, so I want to keep that in this PR.

Learn more

Learn more about provenance and Secure Software Supply Chain on:

• https://slsa.dev
• https://github.com/philips-labs/slsa-provenance-action

Related issue

Part of #78

[Brend Smits (Brend-Smits)]

Looks great and works great.
Can you please include "slsa-provenance" in the readme in the inputs section?

[Jeroen Knoops (JeroenKnoops)]

Looks great and works great. Can you please include "slsa-provenance" in the readme in the inputs section?

Will be done automatically after merged to develop.. the update documentation workflow is triggered on develop and main not on branches to avoid a lot of automated commits.