From f15b0c91d6642735fa4a5eca5f2e4bafd5718436 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Wed, 11 Feb 2026 09:34:10 +0100
Subject: [PATCH] fix missing builder-id in provenance

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/bake.yml  | 5 +++--
 .github/workflows/build.yml | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
index e41e905..7a75366 100644
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -582,6 +582,7 @@ jobs:
           script: |
             const os = require('os');
             const { Bake } = require('@docker/actions-toolkit/lib/buildx/bake');
+            const { Build } = require('@docker/actions-toolkit/lib/buildx/build');
             const { GitHub } = require('@docker/actions-toolkit/lib/github');
             const { Util } = require('@docker/actions-toolkit/lib/util');
             
@@ -709,10 +710,10 @@ jobs:
               bakeOverrides.push('*.tags=');
               if (GitHub.context.payload.repository?.private ?? false) {
                 // if this is a private repository, we set min provenance mode
-                bakeOverrides.push('*.attest=type=provenance,mode=min,version=v1');
+                bakeOverrides.push(`*.attest=type=provenance,${Build.resolveProvenanceAttrs('mode=min,version=v1')}`);
               } else {
                 // for a public repository, we set max provenance mode
-                bakeOverrides.push('*.attest=type=provenance,mode=max,version=v1');
+                bakeOverrides.push(`*.attest=type=provenance,${Build.resolveProvenanceAttrs('mode=max,version=v1')}`);
               }
               if (inpPlatform) {
                 bakeOverrides.push(`*.platform=${inpPlatform}`);
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 21e589e..c09ab32 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -515,6 +515,7 @@ jobs:
           INPUT_META-LABELS: ${{ steps.meta.outputs.labels }}
         with:
           script: |
+            const { Build } = require('@docker/actions-toolkit/lib/buildx/build');
             const { GitHub } = require('@docker/actions-toolkit/lib/github');
             
             const inpPlatform = core.getInput('platform');
@@ -587,10 +588,10 @@ jobs:
             
             if (GitHub.context.payload.repository?.private ?? false) {
               // if this is a private repository, we set min provenance mode
-              core.setOutput('provenance', 'mode=min,version=v1');
+              core.setOutput('provenance', Build.resolveProvenanceAttrs(`mode=min,version=v1`));
             } else {
               // for a public repository, we set max provenance mode
-              core.setOutput('provenance', 'mode=max,version=v1');
+              core.setOutput('provenance', Build.resolveProvenanceAttrs(`mode=max,version=v1`));
             }
       -
         name: Login to registry