-
Notifications
You must be signed in to change notification settings - Fork 118
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
build: use docker to generate and attest SBOMs #3387
Conversation
Signed-off-by: Aryan Bakliwal <106430579+AryanBakliwal@users.noreply.github.com>
Signed-off-by: Aryan Bakliwal <106430579+AryanBakliwal@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please test this out in your own fork to showcase that it works.
you will need to adjust the image tags and stuff to point to different registries that you can push to
Signed-off-by: Aryan Bakliwal <106430579+AryanBakliwal@users.noreply.github.com>
|
I think we want to keep our current setup that attaches the sboms to the releases. I will close this PR |
use docker to generate and attest SBOMs
Right now Keptn is using
anchore/sbom-action
to generate SBOMs for images which generates SBOMs post the build process. This PR addsdocker/build-push-action
to generate and attest the SBOM during the release pipeline.Fixes #3309
How to test
Checklist
into multiple PRs)
see Contribution Guide
the Contribution Guide