that was a silly oversight

.github/workflows/build.yml

@@ -56,7 +56,7 @@ jobs:
         id: attest
         with:
           subject-name: ghcr.io/some-natalie/jekyll-in-a-can
-          subject-digest: ${{ steps.push.outputs.digest }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
           push-to-registry: true
 
       - name: Install cosign