fix(ci): honor managed-image rerun provenance

.github/workflows/managed-images.yaml

@@ -1581,6 +1581,8 @@ jobs:
           set -euo pipefail
           [[ "$GITHUB_RUN_ID" =~ ^[1-9][0-9]{0,19}$ ]]
           [[ "$GITHUB_RUN_ATTEMPT" =~ ^[1-9][0-9]{0,9}$ ]]
+          # Failed-job reruns retain this successful job's original output,
+          # while rerun-all executes it again and must mint fresh immutable aliases.
           printf 'cohort=ghrun-%s-%s\n' "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" >> "$GITHUB_OUTPUT"
 
   reviewed-npm-audit:
@@ -2935,6 +2937,7 @@ jobs:
                     digest,
                     reference,
                     baseReference,
+                    run,
                     publicationEvidence
                   }
                 }) | from_entries)
@@ -2943,7 +2946,11 @@ jobs:
 
           cohort_manifests="$RUNNER_TEMP/managed-image-cohort-manifests.json"
           jq -s 'sort_by(.agent)' "$manifests" > "$cohort_manifests"
-          if ! jq -e '
+          if ! jq -e \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
+            --argjson runId "$GITHUB_RUN_ID" \
+            '
             length == 3
             and ([.[].agent] | sort) == [
               "hermes",
@@ -2964,6 +2971,12 @@ jobs:
               and all(.platforms[];
                 (.digest | test("^sha256:[0-9a-f]{64}$"))
                 and (.baseReference | test("@sha256:[0-9a-f]{64}$"))
+                and (.run | keys | sort) == ["attempt", "id"]
+                and .run.id == $runId
+                and (.run.attempt | type) == "number"
+                and .run.attempt >= 1
+                and (.run.attempt | floor) == .run.attempt
+                and .run.attempt <= $runAttempt
                 and .publicationEvidence.candidateDescriptor.digest == .digest
                 and .publicationEvidence.attestations.manifestDescriptor.annotations[
                   "vnd.docker.reference.digest"
@@ -2972,6 +2985,9 @@ jobs:
                   .publicationEvidence.workloadDescriptor.digest
                 and .publicationEvidence.attestations.spdx.statement.subject.digest ==
                   .publicationEvidence.workloadDescriptor.digest
+                and .publicationEvidence.attestations.slsa.statement.builderId ==
+                  ("https://github.com/" + $repository + "/actions/runs/" +
+                   ($runId | tostring) + "/attempts/" + (.run.attempt | tostring))
               )
             )
           ' "$cohort_manifests" >/dev/null; then
@@ -3117,6 +3133,7 @@ jobs:
             }' > "$cohort_contract"
           jq -e \
             --arg cohort "$cohort" \
+            --arg repository "$GITHUB_REPOSITORY" \
             --arg revision "$GITHUB_SHA" \
             --argjson runAttempt "$GITHUB_RUN_ATTEMPT" \
             --argjson runId "$GITHUB_RUN_ID" \
@@ -3151,10 +3168,19 @@ jobs:
                and .alias == (.image + ":cohort-" + $cohort)
                and (.platforms | keys | sort) == ["linux/amd64", "linux/arm64"]
                and all(.platforms[];
-                 .publicationEvidence.candidateDescriptor.digest == .digest
+                 (.run | keys | sort) == ["attempt", "id"]
+                 and .run.id == $runId
+                 and (.run.attempt | type) == "number"
+                 and .run.attempt >= 1
+                 and (.run.attempt | floor) == .run.attempt
+                 and .run.attempt <= $runAttempt
+                 and .publicationEvidence.candidateDescriptor.digest == .digest
                  and .publicationEvidence.attestations.manifestDescriptor.annotations[
                    "vnd.docker.reference.digest"
                  ] == .publicationEvidence.workloadDescriptor.digest
+                 and .publicationEvidence.attestations.slsa.statement.builderId ==
+                   ("https://github.com/" + $repository + "/actions/runs/" +
+                    ($runId | tostring) + "/attempts/" + (.run.attempt | tostring))
                )
              )' "$cohort_contract" >/dev/null