From cfb4435d208aad48b7ab2346111ce283f33421fd Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Wed, 29 Jul 2026 01:49:40 +0300 Subject: [PATCH 1/2] ci: attach provenance and SBOM attestations to the published MCP server image --- .github/workflows/publish-mcp-server.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-mcp-server.yml b/.github/workflows/publish-mcp-server.yml index 9e2d33680..3d3216143 100644 --- a/.github/workflows/publish-mcp-server.yml +++ b/.github/workflows/publish-mcp-server.yml @@ -129,6 +129,8 @@ jobs: with: context: examples/mcp_server push: true + provenance: mode=max + sbom: true tags: | ${{ env.IMAGE_NAME }}:${{ steps.metadata.outputs.version }} ${{ env.IMAGE_NAME }}:latest @@ -190,4 +192,4 @@ jobs: sleep 10 done echo "Published server did not appear in the Registry within 60 seconds" >&2 - exit 1 + exit 1 \ No newline at end of file From f22d1ca3ef73616ba9e36f138acb3f8f24f742ef Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Wed, 29 Jul 2026 02:25:25 +0300 Subject: [PATCH 2/2] ci: restore trailing newline at end of file --- .github/workflows/publish-mcp-server.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-mcp-server.yml b/.github/workflows/publish-mcp-server.yml index 3d3216143..b395920e0 100644 --- a/.github/workflows/publish-mcp-server.yml +++ b/.github/workflows/publish-mcp-server.yml @@ -192,4 +192,4 @@ jobs: sleep 10 done echo "Published server did not appear in the Registry within 60 seconds" >&2 - exit 1 \ No newline at end of file + exit 1