UID2-6764: Add attestation_enabled opt-out to docker publish workflows

.github/workflows/shared-publish-java-to-docker-versioned.yaml

@@ -42,6 +42,10 @@ on:
         description: GitHub Environment to use for accessing the merge token. Leave empty to use the default GITHUB_TOKEN.
         type: string
         default: ''
+      attestation_enabled:
+        description: If false, skips SLSA build-provenance attestation + verification. Defaults to true.
+        type: boolean
+        default: true
     outputs:
       version_number_output:
         description: The complete version number 
@@ -218,7 +222,7 @@ jobs:
             IMAGE_VERSION=${{ steps.version.outputs.new_version }}
 
       - name: Attest build provenance
-        if: ${{ steps.checkRelease.outputs.not_snapshot == 'true' }}
+        if: ${{ steps.checkRelease.outputs.not_snapshot == 'true' && inputs.attestation_enabled }}
         uses: IABTechLab/uid2-shared-actions/actions/attest_image@v3
         with:
           subject_name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ inputs.append_image_name }}

.github/workflows/shared-publish-to-docker-versioned.yaml

@@ -42,6 +42,10 @@ on:
         description: If true, will attempt to publish any vulnerabilities to GitHub. Defaults to true. Set to false for private repos.
         type: string
         default: 'true'
+      attestation_enabled:
+        description: If false, skips SLSA build-provenance attestation + verification. Defaults to true.
+        type: boolean
+        default: true
 jobs:
   buildImage:
     name: Build Image
@@ -77,6 +81,7 @@ jobs:
           docker_context: ${{ inputs.docker_context }}
           publish_vulnerabilities: ${{ inputs.publish_vulnerabilities }}
           scan_type: image
+          attestation_enabled: ${{ inputs.attestation_enabled }}
 
       - name: Create Release
         id: github_release

actions/shared_publish_to_docker/action.yaml

@@ -32,6 +32,9 @@ inputs:
   scan_type:
     description: The scan-type for aquasecurity/trivy-action action. Default to a fs scan.
     default: fs
+  attestation_enabled:
+    description: Set to 'false' to skip SLSA build-provenance attestation + verification. Default 'true'.
+    default: 'true'
 
 outputs:
   tags:
@@ -103,7 +106,7 @@ runs:
           IMAGE_VERSION=${{ inputs.new_version }}
 
     - name: Attest build provenance
-      if: ${{ inputs.not_snapshot == 'true' }}
+      if: ${{ inputs.not_snapshot == 'true' && inputs.attestation_enabled == 'true' }}
       uses: IABTechLab/uid2-shared-actions/actions/attest_image@v3
       with:
         subject_name: ${{ inputs.docker_registry }}/${{ inputs.docker_image_name }}