also looking at this
fix(release): attach and verify generated SBOM assets
#294
5 files
+108
-18
| @@ -3,14 +3,11 @@ name: SBOM | ||
| 3 | 3 | on: |
| 4 | 4 | push: |
| 5 | 5 | branches: [main] |
| 6 | tags: | |
| 7 | - 'v*' | |
| 8 | release: | |
| 9 | types: [published] | |
| 6 | workflow_call: | |
| 10 | 7 | workflow_dispatch: |
| 11 | 8 | |
| 12 | 9 | concurrency: |
| 13 | group: sbom-${{ github.head_ref || github.ref }} | |
| 10 | group: sbom-${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| 14 | 11 | cancel-in-progress: true |
| 15 | 12 | |
| 16 | 13 | jobs: |
| @@ -208,17 +205,6 @@ jobs: | ||
| 208 | 205 | path: sbom/ |
| 209 | 206 | retention-days: 90 |
| 210 | 207 | |
| 211 | - name: Attach SBOM to release | |
| 212 | if: github.event_name == 'release' | |
| 213 | uses: softprops/action-gh-release@v1 | |
| 214 | with: | |
| 215 | files: | | |
| 216 | sbom/craft-sbom.json | |
| 217 | sbom/full-sbom.cyclonedx.json | |
| 218 | sbom/full-sbom.spdx.json | |
| 219 | env: | |
| 220 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| 221 | ||
| 222 | 208 | - name: Submit to Dependency Graph |
| 223 | 209 | if: github.ref == 'refs/heads/main' |
| 224 | 210 | uses: anchore/sbom-action@v0 |