Mathias Beaulieu-Duncan 6f24c8ef46 Replace cosign with buildx attestations for Docker Scout compliance ...

Docker Scout requires buildx-style provenance+SBOM, not cosign
attestations. Replace crane push with docker load + buildx build
(--provenance=mode=max --sbom=true) for the installer image. Use
buildx imagetools create for the release tag to preserve attestations.
Remove cosign/syft from CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-13 17:05:20 -05:00

..

workflows

Replace cosign with buildx attestations for Docker Scout compliance

2026-02-13 17:05:20 -05:00