ci: sign Docker images with SLSA build provenance

Enable BuildKit provenance (mode=max) + SBOM in the three GHCR image
workflows (rust-docker, monorepo-docker, node-services-docker) and add
actions/attest-build-provenance@v2 to produce a GitHub-signed,
Sigstore-verifiable attestation attached to each pushed image digest.

Consumers can verify with:
  gh attestation verify \\
    oci://ghcr.io/hyperlane-xyz/hyperlane-agent@<digest> \\
    --repo hyperlane-xyz/hyperlane-monorepo

Gated on the same condition as the push step, so PRs from forks
(which do not push) do not attempt to attest.

Author: paulbalaji

.github/workflows/monorepo-docker.yml

@@ -35,6 +35,7 @@ jobs:
       contents: read
       id-token: write
       packages: write
+      attestations: write
 
     steps:
       - uses: actions/checkout@v6
@@ -98,14 +99,23 @@ jobs:
           context: ./
           file: ./Dockerfile
           push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          provenance: false
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             FOUNDRY_VERSION=${{ env.FOUNDRY_VERSION }}
             REGISTRY_COMMIT=${{ env.REGISTRY_VERSION }}
           platforms: ${{ steps.determine-platforms.outputs.platforms }}
 
+      - name: Attest build provenance
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/hyperlane-xyz/hyperlane-monorepo
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+
       - name: Generate job summary
         if: always()
         run: |

.github/workflows/node-services-docker.yml

@@ -35,6 +35,7 @@ jobs:
       id-token: write
       packages: write
       pull-requests: write
+      attestations: write
 
     steps:
       - name: Generate GitHub App Token
@@ -101,14 +102,23 @@ jobs:
           context: ./
           file: ./typescript/Dockerfile
           push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          provenance: false
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             FOUNDRY_VERSION=${{ env.FOUNDRY_VERSION }}
             SERVICE_VERSION=${{ steps.taggen.outputs.TAG_SHA }}-${{ steps.taggen.outputs.TAG_DATE }}
           platforms: ${{ steps.determine-platforms.outputs.platforms }}
 
+      - name: Attest build provenance
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/hyperlane-xyz/hyperlane-node-services
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+
       - name: Generate image tags output
         id: image-tags
         if: always()

.github/workflows/rust-docker.yml

@@ -32,6 +32,7 @@ jobs:
       id-token: write
       packages: write
       pull-requests: write
+      attestations: write
 
     steps:
       - name: Generate GitHub App Token
@@ -107,11 +108,20 @@ jobs:
           context: .
           file: ./rust/Dockerfile
           push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-          provenance: false
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ steps.determine-platforms.outputs.platforms }}
 
+      - name: Attest build provenance
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/hyperlane-xyz/hyperlane-agent
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+
       - name: Comment image tags on PR
         if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && always()
         uses: ./.github/actions/docker-image-comment