cleanup, get proper digest into docker provenance

Signed-off-by: Joe Eltgroth <[email protected]>

.github/actions/srp-helper/publish-container/publish.sh

@@ -34,7 +34,7 @@ observer_agent -m stop_observer -f network_provenance.json
 key="${registry}/${BUILDPACK}-buildpack:${version}"
 echo "key set to ${key}"
 action="publish"
-image="${registry}/${BUILDPACK}-buildpack:${version}"
+image=$(docker inspect --format='{{index .RepoDigests 0}}' "${key}")
 srp provenance add-output docker \
  --set-key="${key}" \
  --action-key="${action}" \
@@ -47,4 +47,5 @@ srp provenance add-input syft --scan-target="${key}" --output-key="${key}"
 srp provenance action import-observation --name="publish" --file=network_provenance.json
 srp provenance action stop
 
+echo "------------- ${SRP_WORKING_DIR}/_provenance.json -------------"
 cat "${SRP_WORKING_DIR}"/_provenance.json