diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index f6b1f2fe4..d5ccbfb3d 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -55,9 +55,11 @@ jobs: - name: Set up Docker Buildx id: buildx uses: docker/setup-buildx-action@master + - name: Get current date id: date run: echo "::set-output name=date::$(date +'%Y-%m-%d')" + - name: Build uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3 with: @@ -75,6 +77,11 @@ jobs: COMMIT=${{ github.sha }} DATE=${{ steps.date.outputs.date }} + - name: SBOM for latest image + uses: anchore/sbom-action@v0 + with: + image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release-please.outputs.release_tag_name }} + artifact-name: ${{ format('{0}-{1}-sbom.spdx',env.IMAGE_NAME, needs.release-please.outputs.release_tag_name) }} go-release: needs: release-please runs-on: ubuntu-latest @@ -90,6 +97,9 @@ jobs: with: go-version: ${{ env.DEFAULT_GO_VERSION }} + - name: Set up syft + uses: anchore/sbom-action/download-syft@v0 + - name: Run GoReleaser uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4 with: diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 6f8696c73..ac5ef5dd8 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -14,12 +14,11 @@ builds: - windows - darwin archives: - - replacements: - darwin: Darwin - linux: Linux - windows: Windows - 386: i386 - amd64: x86_64 + - name_template: >- + {{ .ProjectName }}_{{ .Version }}_{{- title .Os }}_{{- if eq .Arch "amd64" }}x86_64{{- else if eq .Arch "386" }}i386{{- else }}{{ .Arch }}{{ end }} +# Generate SBOM per each archive +sboms: + - artifacts: archive checksum: name_template: 'checksums.txt' snapshot: