build: disable default provenance attestation

[MikeMcC399]

Supports resolution of

• https://github.com/cypress-io/cypress-docker-images/issues/1145
• https://github.com/cypress-io/cypress-docker-images/issues/1095

Issue

• Docker Buildx v0.10.0 introduced a breaking change causing multi-architecture manifests to use oci instead of docker imageType formats. The release notes warn about issues with registry and runtime support. This already caused a issue in this repo (see https://github.com/cypress-io/cypress-docker-images/issues/1141). It is unknown whether allowing the manifest imageType to change for Cypress Docker images would cause usage issues in users' environments and it would have to be considered as a breaking change for Cypress Docker.

• This repo is currently using Buildx v0.9.1 so this issue needs to be considered and prepared before any update to Buildx v0.10.x takes place:

  Image tag	Node.js	Docker Engine	buildx	Status
  ubuntu-2204:2022.10.2	16.17.1	20.10.18	v0.9.1	Current

Change

In order to keep the current manifest schema as follows:

"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",

instead of moving to

"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.index.v1+json",

an environment variable setting BUILDX_NO_DEFAULT_ATTESTATIONS=1, introduced in Buildx 0.10.4, is added to the push job of the circle.yml workflow.

[cypress-app-bot]

• Create a Draft Pull Request if your PR is not ready for review. Mark the PR as Ready for Review when you're ready for a Cypress team member to review the PR.

[MikeMcC399]

Merging this PR should have no impact on the current build workflow. It prepares for the update to Docker Buildx v0.10.0 and later, and it protects against changes to any published manifest's imageType.