Fix provenance: pass only predicate to cosign, not full in-toto statement

cosign attest --type slsaprovenance expects the predicate JSON only
(builder, buildType, invocation, metadata). It wraps it in the
in-toto statement envelope itself. Passing the full statement caused
cosign to look for builder at the wrong nesting level.

Ref: https://github.com/sigstore/cosign/issues/3757

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/publish.yaml

@@ -150,12 +150,7 @@ jobs:
           COSIGN_YES: "true"
         run: |
           IMAGE_DIGEST="${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}@${{ steps.publish.outputs.digest }}"
-          DIGEST_SHA=$(echo '${{ steps.publish.outputs.digest }}' | sed 's/sha256://')
           jq -n \
-            --arg type "https://in-toto.io/Statement/v0.1" \
-            --arg predType "https://slsa.dev/provenance/v0.2" \
-            --arg name "${{ steps.publish.outputs.image_versioned }}" \
-            --arg sha "$DIGEST_SHA" \
             --arg builder "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --arg buildType "https://apko.dev/build/v1" \
             --arg uri "${{ github.server_url }}/${{ github.repository }}" \
@@ -163,10 +158,6 @@ jobs:
             --arg entry "${{ matrix.config }}" \
             --arg runId "${{ github.run_id }}" \
             '{
-              "_type": $type,
-              "predicateType": $predType,
-              "subject": [{"name": $name, "digest": {"sha256": $sha}}],
-              "predicate": {
               "builder": {"id": $builder},
               "buildType": $buildType,
               "invocation": {
@@ -176,7 +167,6 @@ jobs:
                 "buildInvocationID": $runId,
                 "completeness": {"parameters": true, "environment": true, "materials": true}
               }
-              }
             }' > /tmp/provenance.json
           cosign attest --predicate /tmp/provenance.json --type slsaprovenance "${IMAGE_DIGEST}"
           echo "Provenance attestation attached successfully"

.gitea/workflows/rebuild.yaml

@@ -149,12 +149,7 @@ jobs:
           COSIGN_YES: "true"
         run: |
           IMAGE_DIGEST="${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}@${{ steps.publish.outputs.digest }}"
-          DIGEST_SHA=$(echo '${{ steps.publish.outputs.digest }}' | sed 's/sha256://')
           jq -n \
-            --arg type "https://in-toto.io/Statement/v0.1" \
-            --arg predType "https://slsa.dev/provenance/v0.2" \
-            --arg name "${{ steps.publish.outputs.image_versioned }}" \
-            --arg sha "$DIGEST_SHA" \
             --arg builder "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --arg buildType "https://apko.dev/build/v1" \
             --arg uri "${{ github.server_url }}/${{ github.repository }}" \
@@ -162,10 +157,6 @@ jobs:
             --arg entry "${{ matrix.config }}" \
             --arg runId "${{ github.run_id }}" \
             '{
-              "_type": $type,
-              "predicateType": $predType,
-              "subject": [{"name": $name, "digest": {"sha256": $sha}}],
-              "predicate": {
               "builder": {"id": $builder},
               "buildType": $buildType,
               "invocation": {
@@ -175,7 +166,6 @@ jobs:
                 "buildInvocationID": $runId,
                 "completeness": {"parameters": true, "environment": true, "materials": true}
               }
-              }
             }' > /tmp/provenance.json
           cosign attest --predicate /tmp/provenance.json --type slsaprovenance "${IMAGE_DIGEST}"
           echo "Provenance attestation attached successfully"

.gitea/workflows/update-check.yaml

@@ -231,12 +231,7 @@ jobs:
           COSIGN_YES: "true"
         run: |
           IMAGE_DIGEST="${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}@${{ steps.publish.outputs.digest }}"
-          DIGEST_SHA=$(echo '${{ steps.publish.outputs.digest }}' | sed 's/sha256://')
           jq -n \
-            --arg type "https://in-toto.io/Statement/v0.1" \
-            --arg predType "https://slsa.dev/provenance/v0.2" \
-            --arg name "${{ steps.publish.outputs.image_versioned }}" \
-            --arg sha "$DIGEST_SHA" \
             --arg builder "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --arg buildType "https://apko.dev/build/v1" \
             --arg uri "${{ github.server_url }}/${{ github.repository }}" \
@@ -244,10 +239,6 @@ jobs:
             --arg entry "${{ matrix.config }}" \
             --arg runId "${{ github.run_id }}" \
             '{
-              "_type": $type,
-              "predicateType": $predType,
-              "subject": [{"name": $name, "digest": {"sha256": $sha}}],
-              "predicate": {
               "builder": {"id": $builder},
               "buildType": $buildType,
               "invocation": {
@@ -257,7 +248,6 @@ jobs:
                 "buildInvocationID": $runId,
                 "completeness": {"parameters": true, "environment": true, "materials": true}
               }
-              }
             }' > /tmp/provenance.json
           cosign attest --predicate /tmp/provenance.json --type slsaprovenance "${IMAGE_DIGEST}"
           echo "Provenance attestation attached successfully"