Authenticate OCI evidence publication

.github/workflows/container-release.yml

@@ -262,6 +262,15 @@ jobs:
           ' "$temporary" >/dev/null
           mv "$temporary" shadowshield-sbom.cdx.json
 
+      - name: Authenticate for OCI attestations
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$GH_TOKEN" \
+            | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
       - name: Attest release image provenance
         if: github.event_name == 'release' && steps.image.outputs.reused != 'true'
         uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
@@ -280,6 +289,11 @@ jobs:
           push-to-registry: true
           create-storage-record: false
 
+      - name: Remove OCI registry credentials
+        if: always()
+        shell: bash
+        run: docker logout ghcr.io
+
       - name: Verify signed release provenance
         shell: bash
         env:

tests/test_workflow_policy.py

@@ -134,6 +134,16 @@ def test_release_builds_install_hash_locked_dependencies() -> None:
     assert container_release.index("id: push") < container_release.index(
         "name: Canonicalize release SBOM"
     )
+    canonicalize_index = container_release.index("name: Canonicalize release SBOM")
+    registry_auth_index = container_release.index("name: Authenticate for OCI attestations")
+    sbom_attestation_index = container_release.index("name: Attest release image SBOM")
+    registry_logout_index = container_release.index("name: Remove OCI registry credentials")
+    assert canonicalize_index < registry_auth_index < sbom_attestation_index
+    assert sbom_attestation_index < registry_logout_index
+    assert "printf '%s' \"$GH_TOKEN\"" in container_release
+    assert "docker login ghcr.io" in container_release
+    assert "if: always()" in container_release[registry_logout_index:]
+    assert "docker logout ghcr.io" in container_release[registry_logout_index:]
     assert 'test "$tags_verified" = true' in container_release
     assert "gh release upload" in container_release
     assert "--clobber" not in container_release