Attach a CycloneDX SBOM as a keyless cosign attestation to a container image pushed to GHCR using Sigstore's public Fulcio CA

Steps

1. Build and push the container image to GHCR, then generate the CycloneDX SBOM using Syft: syft scan <IMAGE>:<TAG> -o cyclonedx-json=sbom.cdx.json
2. In a GitHub Actions workflow, authenticate to Sigstore using the GITHUB_TOKEN-backed OIDC identity; cosign 2.x picks up the OIDC token from the environment automatically when running in GitHub Actions with id-token: write permission
3. Attest the SBOM using: cosign attest --type cyclonedx --predicate sbom.cdx.json <IMAGE>@<DIGEST> — use the image digest (not tag) as the reference to ensure the attestation is bound to an immutable identifier
4. cosign attest uploads the attestation as an OCI referrer to the same registry namespace; verify it with cosign verify-attestation --type cyclonedx --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp <WORKFLOW_REF> <IMAGE>@<DIGEST>
5. Inspect the stored attestation using crane ls <IMAGE> to see referrer tags, or use the OCI referrers API to enumerate all attached artifacts