Specify the builder id for provenance

[LaurentGoderre]

When generating a provenance using the GitHub Action Build-Push Action the action sets the builder id as the URL for the current build. This replicates this behavior.

Example
https://oci.dag.dev/?blob=docker/image-signer-verifier@sha256:56e95d5cbc3afae22c0023f0e386cd04254de1ecd6b98b0b1da483b2a28b1c73&mt=application%2Fvnd.in-toto%2Bjson&size=11949

"builder": {
  "id": "https://github.com/docker/image-signer-verifier/actions/runs/9620065389/attempts/1"
},

We are wondering however if the GitHub Action run url is the best value to use of if a different URL would be better suited.

[jonnystoten]

Thanks @LaurentGoderre ! This is helpful for us when verifying the provenance of DOI because this is a common value to look for across all DOI with provenance attestations.

To fully replicate the docker/build-push-action behavior we'd need to include the "attempt" in the URL too, see their implementation here.

[jonnystoten]

Missing closing quote here:

Suggested change

	"--provenance=\"mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID",
	"--provenance=\"mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID\"",

[tianon]

This is helpful for us when verifying the provenance of DOI because this is a common value to look for across all DOI with provenance attestations.

Can you please elaborate more on this? In what way will it be used/validated? Just that it starts with https://github.com/docker-library/meta/actions/...?

They won't necessarily all look that way -- this PR would also need to account for builds that happen on Jenkins, which does have similar environment variables, but as they won't be terribly stable / long-lived URLs in either case, I'd like to understand more about what the actual underlying use case is before I can reasonably opine on what the best solution/value is.