UID2-6764: Add SLSA build provenance attestations to docker publish workflows

[BehnamMozafari]

Summary

Adds SLSA build-provenance attestation to every non-snapshot image published by the shared docker workflows.

• New composite action actions/attest_image wraps the full attest+verify path: it lowercases the image ref once, calls actions/attest@v4.1.0 (pinned to 59d8942), and immediately runs gh attestation verify against the just-pushed digest.
• Both shared-publish-java-to-docker-versioned.yaml and actions/shared_publish_to_docker/action.yaml now call attest_image@v3 instead of inlining the attest block.
• Publish jobs gain id-token: write and attestations: write.
• Attestation is skipped on snapshot builds via the existing not_snapshot guard.

Closes UID2-6764. Spike was UID2-5763.

Review-comment responses

#	Comment	Resolution
1	Real smoke test without the attest step skipped	Added a temporary test-attest-image.yaml workflow that exercised the full attest+verify path against a throwaway image. Run 25542801315 green; full evidence below. Workflow then deleted in 3954ca4 since the captured evidence is permanent.
2	Add gh attestation verify step	Built into attest_image so every release verifies in CI before any consumer pulls.
3	Case sensitivity of subject-name	actions/attest@v4 already auto-lowercases subject-name when push-to-registry: true (verified in src/main.ts → downcaseName: inputs.pushToRegistry, applied at src/subject.ts line 47). However, gh attestation verify does not lowercase the OCI URI we pass it. To keep the signed name and the verify URI byte-identical, attest_image lowercases once at the top and reuses the value for both. (The smoke test caught a real case-sensitivity failure in the first run when ${{ github.repository }} evaluated to IABTechLab/... and docker push rejected it — proves the concern is real.)
4	Comment for NODE_OPTIONS	Added inline in attest_image/action.yaml: Mirrors actions/attest-build-provenance, prevents oversized OCI registry auth-challenge headers triggering HPE_HEADER_OVERFLOW.
5	Extract duplication into a composite action	Done — actions/attest_image/action.yaml is the single implementation.

Smoke test evidence

Run 25542801315 — all 9 steps green in 38s.

Test image: ghcr.io/iabtechlab/uid2-shared-actions/test-attest@sha256:e008cbdd1c67eee898020ad96d56ff0d42d762585ef4c1153479abaf5a4112bb

$ gh attestation verify \
    "oci://ghcr.io/iabtechlab/uid2-shared-actions/test-attest@sha256:e008cbdd1c67eee898020ad96d56ff0d42d762585ef4c1153479abaf5a4112bb" \
    --owner "IABTechLab"
Loaded digest sha256:e008cbdd1c67eee898020ad96d56ff0d42d762585ef4c1153479abaf5a4112bb for oci://ghcr.io/iabtechlab/uid2-shared-actions/test-attest@sha256:e008cbdd1c67eee898020ad96d56ff0d42d762585ef4c1153479abaf5a4112bb
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/IABTechLab
- Subject Alternative Name must match regex: (?i)^https://github.com/IABTechLab/
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... IABTechLab/uid2-shared-actions
  - Build workflow:. .github/workflows/test-attest-image.yaml@refs/heads/bmz-UID2-6764-artifact-attestation
  - Signer repo:.... IABTechLab/uid2-shared-actions
  - Signer workflow: .github/workflows/test-attest-image.yaml@refs/heads/bmz-UID2-6764-artifact-attestation

End-to-end chain: image digest → SLSA v1 provenance → workflow file at the exact branch ref → GitHub-hosted runner OIDC identity.

Test plan

• Snapshot smoke test on IABTechLab/uid2-admin (Java path) — run 25421656856 — workflow succeeded, "Attest build provenance" step skipped (proves the not_snapshot guard works).
• Real attest+verify smoke test — run 25542801315 — full attest+verify path green; external gh attestation verify succeeds (output above).
• Release-tag E2E on each consumer's first real publish after v3 float is promoted; verified digests will be recorded in the UID2-6764 ticket.

Post-merge sequence

1. Merge this PR.
2. Run update-major-version-tags.yaml on main immediately after — the refactored workflows reference actions/attest_image@v3, and the window between merge and tag promotion is a window where consumers triggering would fail with "action not found".
3. Merge each of the 6 caller-repo follow-up PRs below.
4. On each consumer's first real publish, capture the verified digest in UID2-6764.
5. Delete IABTechLab/uid2-admin:bmz-UID2-6764-test (only existed to pin the shared workflow at the feature branch for the snapshot smoke test).

Caller-repo follow-up — already opened (one PR each, all open as of 2026-05-08)

Repo	PR
IABTechLab/uid2-operator	#2531
IABTechLab/uid2-core	#403
IABTechLab/uid2-admin	#632
IABTechLab/uid2-optout	#402
UnifiedID2/uid2-snowflake	#299
UnifiedID2/uid2-databricks	#132

Each grants id-token: write + attestations: write (plus the implicit defaults the publish job already relied on). They're additive and harmless until this PR merges and v3 is promoted.

SDK images are explicitly out of scope; follow-up ticket to be filed separately.

[jon8787]

Can we do a real smoke test without "Attest build provenance" step being skipped?
e.g. using uid2-test-source or similar?