build: sign each attestation

Signed-off-by: CrazyMax <[email protected]>

Author: crazy-max

.github/workflows/build.yml

@@ -124,7 +124,7 @@ jobs:
           annotations: ${{ inputs.set-meta-annotations && steps.meta.outputs.annotations || '' }}
           github-token: ${{ secrets.github-token || github.token }}
       -
-        name: Get attestations manifest digest
+        name: Get attestations digest
         id: attest
         uses: actions/github-script@v7
         env:
@@ -141,11 +141,28 @@ jobs:
                   throw new Error(res.stderr);
                 }
                 manifest = JSON.parse(res.stdout.trim());
-                core.info(JSON.stringify(manifest, null, 2));
               });
             });
+            
+            let attestationManifestDigests = [];
             await core.group(`Get attestations manifest digest`, async () => {
-              const attestationDigests = manifest.manifests.filter(m => m.annotations && m.annotations['vnd.docker.reference.type'] === 'attestation-manifest').map(m => m.digest);
+              attestationManifestDigests = manifest.manifests.filter(m => m.annotations && m.annotations['vnd.docker.reference.type'] === 'attestation-manifest').map(m => m.digest);
+              core.info(JSON.stringify(attestationManifestDigests, null, 2));
+            });
+            
+            await core.group(`Get attestations digest`, async () => {
+              let attestationDigests = [];
+              for (const digest of attestationManifestDigests) {
+                await exec.getExecOutput('docker', ['buildx', 'imagetools', 'inspect', `${core.getInput('image-name')}@${digest}`, '--format', '{{json .Digest}}'], {
+                  ignoreReturnCode: true
+                }).then(res => {
+                  if (res.stderr.length > 0 && res.exitCode != 0) {
+                    throw new Error(res.stderr);
+                  }
+                  manifest = JSON.parse(res.stdout.trim());
+                  attestationDigests = attestationDigests.concat(manifest.layers.map(layer => layer.digest));
+                });
+              }
               core.info(JSON.stringify(attestationDigests, null, 2));
               core.setOutput('digests', attestationDigests.join('\n'));
             });