Docker build-and-push fails: attestations (provenance/SBOM) unsupported on the default buildx docker driver

Treasury REST API · Build and Push Docker Image to Harbor fails at the build step on every develop push:

ERROR: failed to build: Attestation is not supported for the docker driver.
##[error]buildx failed with: Learn more at https://docs.docker.com/go/attestations/

Cause

.github/workflows/treasury-rest-api-docker.yml sets provenance: true + sbom: true on docker/build-push-action@v6 (added for audit finding global/infra/0004), but no docker/setup-buildx-action step runs first. Without it the action falls back to the default docker driver, which cannot emit attestations — only the docker-container driver can.

Impact

• No image has been pushed for the current develop SHA, so the development-sha-* tag Argo CD Image Updater watches is stale and UAT is not running the latest build.
• The develop→main release PR (#2) shows this as its only red check (mergeStateStatus: UNSTABLE), and merging would fail the production-sha-* push the same way — i.e. the release would merge but never deploy.

Fix

Add docker/setup-buildx-action@v3 ahead of the build step so buildx runs on the docker-container driver, keeping provenance/sbom intact.

Acceptance

• Workflow completes green on a develop push.
• development-sha-<short> + latest land in paradaux-public/treasury-rest-api in Harbor, carrying provenance and SBOM attestations.