docker scout

[mathieu-benoit]

• Pre-install docker scout in DevContainer
• Use docker scout quickview|compare in PR
• Add --sbom=true --provenance=true in docker build

Before:

docker scout quickview test:local
    ✓ Image stored for indexing
    ✓ Indexed 11 packages
    ✓ Provenance obtained from attestation

    i Base image was auto-detected. To get more accurate results, build images with max-mode provenance attestations.
      Review docs.docker.com ↗ for more information.

  Target   │  test:local    │    0C     0H     0M     1L
    digest │  60c7bf78b862  │

After, with --sbom=true --provenance=true:

docker scout quickview test:local
    ✓ Image stored for indexing
    ✓ SBOM obtained from attestation, 9 packages found
    ✓ Provenance obtained from attestation
    ✓ Pulled

  Target   │  test:local    │    0C     0H     0M     1L
    digest │  96d9021af8df  │

[mathieu-benoit]

As per https://docs.docker.com/build/ci/github-actions/attestations/#sbom:

Note that adding attestations to an image means you must push the image to a registry directly, as opposed to loading the image to the local image store of the runner. This is because the local image store doesn't support loading images with attestations.