1 changed files with 2 additions and 2 deletions
@@ -89,8 +89,8 @@ jobs:
          # would cause the push to fail on the referrer PUT. The Grype scan step
          # above is the compensating control — it fails the build on any unfixed
          # high-severity CVE before the image reaches the registry.
-          provenance: false
-          sbom: false
+          provenance: true
+          sbom: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}