Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SBOM generation to workflows and releases #187

Merged
merged 1 commit into from
Apr 5, 2023
Merged

Conversation

felddy
Copy link
Owner

@felddy felddy commented Apr 5, 2023

🗣 Description

This PR adds SBOM generation for each supported platform.
The SBOMs will be attached in an artifact for the workflow that generated the images.
If the workflow is part of a release or tag, the the SBOMs will be attached individually as assets to the release.
It also, cleans up some of the name tags in the build workflow.

💭 Motivation and context

A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management. A SBOM is a nested inventory, a list of ingredients that make up software components.

See:

🧪 Testing

Tested in ci-testing repository and in the v11 branch.

✅ Pre-approval checklist

  • This PR has an informative and human-readable title.
  • Changes are limited to a single goal - eschew scope creep!
  • All relevant type-of-change labels have been added.
  • I have read the CONTRIBUTING document.
  • These code changes follow cisagov code standards.
  • All relevant repo and/or project documentation has been updated
    to reflect the changes in this PR.
  • All new and existing tests pass.

@felddy felddy self-assigned this Apr 5, 2023
@felddy felddy merged commit e9c92ad into develop Apr 5, 2023
@felddy felddy deleted the feature/sbom branch April 5, 2023 21:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant