Updated Windows workflow

.github/workflows/images_build_windows.yml

@@ -155,6 +155,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      attestations: write
     strategy:
       fail-fast: false
       matrix:
@@ -204,7 +205,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
         with:
-          images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REPOSITORY }}/${{ env.IMAGES_PREFIX }}${{ env.BASE_IMAGE_NAME }}
+          images: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_NAME ) }}
           context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
           tags: |
             type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-
@@ -261,6 +262,8 @@ jobs:
                --label org.opencontainers.image.created=$Env:LABEL_CREATED
                --build-arg=OS_BASE_IMAGE=$baseOsImage
                --file=$dockerfile
+               --provenance=mode=max,version=v1
+               --sbom
                $tagArgs
             $context
           "@
@@ -269,6 +272,8 @@ jobs:
                        --label org.opencontainers.image.created=$Env:LABEL_CREATED `
                        --build-arg=OS_BASE_IMAGE=$baseOsImage `
                        --file=$dockerfile `
+                       --provenance=mode=max,version=v1 `
+                       --sbom `
                        $tagArgs `
                        $context
           if (-not $?) { throw "Failed to build image" }
@@ -319,6 +324,13 @@ jobs:
           cosign sign --yes $tagList
           echo "::endgroup::"
 
+      - name: Attest images
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_NAME ) }}
+          subject-digest: ${{ steps.docker_build.outputs.digest }}
+          push-to-registry: true
+
       - name: Image digest
         env:
           DIGEST: ${{ steps.docker_build.outputs.digest }}