Build

Move to using providers instead of inline time based schdules, this will solidify the provider contract as a first class API #198

Job	Run time
⚖️ Verify SPDX License Headers	3s
🔐 Verify Signed Commits	5s
🎨 Check Formatting	7s
🧾 Validate VEX Statements	10s
🛡️ Security Vulnerability Scan	15s
🔏 Validate Auto-VEX Sign-off	1m 58s
🧪 cargo-deny (License + Advisory + Sources)	21s
🏷️ Extract Version Information	6s
🏗️ IaC Security Scan (Trivy config)	23s
🦀 Build - Linux ARM64	5m 5s
🦀 Build - Linux x86_64	6m 28s
📦 Package Deployment Manifests	-1s
📎 Clippy	1m 24s
🧪 Test	1m 57s
✍️ Sign Binary Artifacts	0s
🔬 Generate SLSA Provenance Subjects	0s
🏛️ Generate SLSA Provenance	0s
🐳 Build and Push Docker Image - Distroless	36s
🐳 Build and Push Docker Image - Chainguard	23s
🔏 Attest Docker Image - Chainguard	10s
🔏 Attest Docker Image - Distroless	8s
🔭 Grype Triage Scan - ${{ matrix.variant.name }}	0s
🤖 Auto-VEX (reachability)	0s
🤖 Auto-VEX (presence)	0s
🔭 Container Security Scan - Chainguard	28s
🔭 Container Security Scan - Distroless	37s
🧾 Assemble OpenVEX	0s
🚀 Upload Release Assets	0s
	20m 43s

Provide feedback