feat(minio): enable minio vanilla and updated to 0.20250907 Release (#14)

Co-authored-by: Frederic Spiers <frederic.spiers@gitguardian.com>

Author: ixxeL2097

.github/workflows/minio.yaml

@@ -0,0 +1,40 @@
+name: minio
+
+on:
+  schedule:
+    - cron: "00 01 * * 1-5"
+  pull_request:
+    paths:
+      - .github/workflows/minio.yaml
+      - 'images/minio/*.yaml'
+      - 'images/minio/**/*.yaml'
+  push:
+    branches:
+      - 'main'
+    paths:
+      - .github/workflows/minio.yaml
+      - 'images/minio/*.yaml'
+      - 'images/minio/**/*.yaml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
+  security-events: write
+  actions: read
+
+jobs:
+  publish:
+    strategy:
+      matrix:
+        # https://images.chainguard.dev/directory/image/minio/versions
+        version: [latest, "0.20250907", "0.20250723", "0.20250524"]
+        variant: ["prod"]
+    name: ${{ matrix.version }}
+    uses: './.github/workflows/release.yaml'
+    with:
+      tag: ${{ matrix.version }}
+      target: ${{ format('{0}/{1}', matrix.version, matrix.variant) }}
+    secrets: inherit

images/minio/0.20250524/shell.yaml

@@ -0,0 +1,6 @@
+include: images/minio/prod.yaml
+
+contents:
+  packages:
+    - mc~0.20250813
+    - minio~0.20250907

images/minio/0.20250723/shell.yaml

@@ -0,0 +1,90 @@
+# minio
+
+Minimal image with Minio.
+
+## Versions
+
+| 📌 Version  | ⬇️ Pull URL                               | Support |
+| ---------- | ------------------------------------------ | ------- |
+| latest     | ghcr.io/gitguardian/wolfi/minio:latest     | ✅       |
+| 0.20250907 | ghcr.io/gitguardian/wolfi/minio:0.20250907 | ✅       |
+| 0.20250723 | ghcr.io/gitguardian/wolfi/minio:0.20250723 | ✅       |
+| 0.20250524 | ghcr.io/gitguardian/wolfi/minio:0.20250524 | ✅       |
+
+
+## ✅ Verify the Provenance
+
+GitHub CLI ([gh](https://cli.github.com/)) can be used to retrieve the build provenance, which details the exact commit, workflow, and runner that produced the image:
+
+- **Production image**
+
+```shell
+gh attestation verify \
+  --owner gitguardian \
+  oci://ghcr.io/gitguardian/wolfi/minio:latest
+```
+
+## 📦 **Image Verification**
+
+All official images are **cryptographically signed** using [Sigstore Cosign](https://www.sigstore.dev/).
+
+### ✅ Verify the Image Signature
+
+To ensure the image is authentic and has not been tampered with, use the following command:
+
+- **Production image**
+
+```shell
+cosign verify \
+  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+  --certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
+  ghcr.io/gitguardian/wolfi/minio:latest | jq
+```
+
+### 📦 **Image SBOMs**
+
+To enhance transparency, we generate SBOMs for each release. SBOMs are available directly from the container registry
+and can be verified using using [Sigstore Cosign](https://www.sigstore.dev/).
+
+#### ✅ Verify the Image Attestations
+
+- **Production image**
+
+```shell
+cosign verify-attestation \
+  --type=https://spdx.dev/Document \
+  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+  --certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
+  ghcr.io/gitguardian/wolfi/minio:latest
+```
+
+This will pull in the signature for the attestation specified by the --type parameter, which in this case is the SPDX attestation. You will receive output that verifies the SBOM attestation signature in cosign's transparency log:
+
+```shell
+Verification for ghcr.io/gitguardian/wolfi/minio:latest --
+The following checks were performed on each of these signatures:
+  - The cosign claims were validated
+  - Existence of the claims in the transparency log was verified offline
+  - The code-signing certificate was verified using trusted certificate authority certificates
+Certificate subject: https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main
+Certificate issuer URL: https://token.actions.githubusercontent.com
+GitHub Workflow Trigger: push
+GitHub Workflow SHA: ced6b3cfab1341509de55bff7c0389ce81f73aae
+GitHub Workflow Name: minio
+GitHub Workflow Repository: GitGuardian/wolfi
+GitHub Workflow Ref: refs/heads/main
+...
+```
+
+#### ✅ Download the Image SBOM Attestations
+
+To download an attestation, use the `cosign` download attestation command and provide both the predicate type and the build platform. For example, the following command will obtain the SBOM for the python image on `linux/amd64`:
+
+- **Production image**
+
+```shell
+cosign download attestation \
+  --platform=linux/amd64 \
+  --predicate-type=https://spdx.dev/Document \
+  ghcr.io/gitguardian/wolfi/minio:latest | jq -r .payload | base64 -d | jq .predicate
+```

images/minio/0.20250907/prod.yaml

@@ -0,0 +1,6 @@
+include: images/minio/prod.yaml
+
+contents:
+  packages:
+    - mc
+    - minio

images/minio/README.md

@@ -0,0 +1,23 @@
+include: images/apko.yaml
+
+contents:
+  packages:
+    - coreutils
+    - busybox
+
+paths:
+  - path: /data
+    type: directory
+    permissions: 0o770
+    uid: 65532
+    gid: 65532
+
+entrypoint:
+  command: /usr/bin/minio
+
+cmd: server /data --console-address :9090 --address :9000
+
+annotations:
+  org.opencontainers.image.title: 'MinIO'
+  org.opencontainers.image.description: 'MinIO image based on Wolfi OS'
+  org.opencontainers.image.source: 'https://github.com/GitGuardian/wolfi/tree/main/images/minio'