Add provenance/attestation to embeddings build

[brikin01]

Summary

• Adds signed provenance for the private embeddings vector-store image.
• Attests the immutable mcp-embedding-vectorstore digest using GitHub OIDC/Sigstore.
• Publishes the signed attestation to GitHub’s public attestation service and attaches a copy to the private GHCR image.
• Records the image reference, tag, source commit, and attestation URL in the workflow summary.
• Verifies both attestation copies against the expected repository, workflow, source ref, commit, and image digest.

External verification

An external party can inspect the public GitHub-hosted attestation record without access to the private embeddings image: https://github.com/arm/mcp/attestations/40326751. Full artifact verification—including confirming the attestation against the actual image or its OCI-attached copy—would require read access to the private GHCR package.

SLSA scope

This establishes signed, verifiable provenance for the embeddings artifact but does not claim SLSA Build Level 3, which is not necessarily needed for this private intermediate artifact. The final released MCP image is handled separately and remains subject to the Level 3 target.

Workflow with added attestation logic ran without error: https://github.com/arm/mcp/actions/runs/31620027846.

[Copilot]

Pull request overview

Adds signed, verifiable provenance attestation to the private embeddings vector-store container image built by the embeddings workflow, and verifies that attestation (both GitHub-hosted and OCI-attached) against the expected repo/workflow/ref/commit/digest.

Changes:

• Grants OIDC + attestation-related permissions to the vectorstore build job and emits the attestation URL as a job output.
• Generates provenance using actions/attest for the published vectorstore image digest and records the attestation URL in the workflow summary.
• Adds a follow-on job that verifies the attestation via GitHub’s attestation service and via the registry-attached bundle (--bundle-from-oci).

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.