Supply-chain docs + publish summary for cosign/SBOM

Author: omniscoder

.github/workflows/docker-publish.yml

@@ -193,3 +193,17 @@ jobs:
         run: |
           set -euo pipefail
           cosign attest --yes --type spdxjson --predicate sbom.spdx.json "${{ steps.image.outputs.image }}@${{ steps.image.outputs.digest }}"
+
+      - name: Publish summary
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "### crispr-gpu CPU image published"
+            echo ""
+            echo "- Image: \`${{ steps.image.outputs.image }}@${{ steps.image.outputs.digest }}\`"
+            echo "- Cosign signature ref: \`${{ steps.cosign.outputs.signature_ref }}\`"
+            echo "- Git ref: \`${{ steps.vars.outputs.tag }}\`"
+            echo "- Git sha: \`${{ steps.git.outputs.sha }}\`"
+            echo "- Workflow run id: \`${{ github.run_id }}\`"
+          } >> "$GITHUB_STEP_SUMMARY"

docs/supply_chain.md

@@ -21,17 +21,19 @@ DIGEST="sha256:..."   # immutable digest, not a tag
 Verify the signature for the digest:
 ```bash
 cosign verify \
-  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' \
+  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/(tags/v[0-9]+\.[0-9]+\.[0-9]+|heads/master)$' \
   --certificate-issuer 'https://token.actions.githubusercontent.com' \
   "${IMAGE}@${DIGEST}"
 ```
 
+If you want *strict release-only* verification, tighten the identity to `@refs/tags/vX.Y.Z` instead of allowing `@refs/heads/master`.
+
 ## Verify an SBOM attestation exists (same digest)
 
 ```bash
 cosign verify-attestation \
   --type spdxjson \
-  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' \
+  --certificate-identity-regexp '^https://github.com/omniscoder/crispr-gpu/.github/workflows/docker-publish\.yml@refs/(tags/v[0-9]+\.[0-9]+\.[0-9]+|heads/master)$' \
   --certificate-issuer 'https://token.actions.githubusercontent.com' \
   "${IMAGE}@${DIGEST}"
 ```
@@ -48,4 +50,3 @@ docker run --rm \
   -v "$(pwd)/reports_docker:/out" \
   "${IMAGE}@${DIGEST}"
 ```
-