Build

Move to using providers instead of inline time based schdules, this will solidify the provider contract as a first class API #200

Job	Run time
🔐 Verify Signed Commits	5s
⚖️ Verify SPDX License Headers	6s
🧾 Validate VEX Statements	9s
🛡️ Security Vulnerability Scan	13s
🧪 cargo-deny (License + Advisory + Sources)	24s
🏗️ IaC Security Scan (Trivy config)	18s
🔏 Validate Auto-VEX Sign-off	1m 43s
🎨 Check Formatting	9s
🏷️ Extract Version Information	7s
🦀 Build - Linux ARM64	4m 25s
🦀 Build - Linux x86_64	6m 0s
📦 Package Deployment Manifests	0s
📎 Clippy	1m 25s
🧪 Test	2m 20s
✍️ Sign Binary Artifacts	-1s
🔬 Generate SLSA Provenance Subjects	0s
🏛️ Generate SLSA Provenance	0s
🐳 Build and Push Docker Image - Chainguard	38s
🐳 Build and Push Docker Image - Distroless	30s
🔏 Attest Docker Image - Distroless	18s
🔏 Attest Docker Image - Chainguard	8s
🔭 Container Security Scan - Chainguard	34s
🔭 Container Security Scan - Distroless	30s
🔭 Grype Triage Scan - ${{ matrix.variant.name }}	-1s
🤖 Auto-VEX (reachability)	-1s
🤖 Auto-VEX (presence)	-1s
🧾 Assemble OpenVEX	-1s
🚀 Upload Release Assets	0s
	19m 57s

Provide feedback