chore: add sbom generation for releases #337
Conversation
Kavindu-Dodan
requested review from
AlexsJones,
james-milligan and
toddbaert
as code owners
Kavindu-Dodan
changed the title
|
@Kavindu-Dodan should we also add SBOM generation for the container image, like it OFO? https://github.com/open-feature/open-feature-operator/blob/312e91e6f9c1c44b9d642c74e031742f78c0f7f9/.github/workflows/release-please.yml#L124 |
|
@Kavindu-Dodan Also I think the title should be "chore" or something like that. This is a "feature" in terms of security features, but not a new functional feature in flagd in the sense of semver or compatibility. |
Kavindu-Dodan
changed the title
Kavindu-Dodan
force-pushed
the
feature/sbom-to-release
branch
from
2b57b54
to
e297f35
Compare
Per my understanding, we are not scanning the image for SBOM generation in OFO but rather scanning only the source [1]. I will update this PR to introduce image scanning [2] . We might have to do the same (after validating things here) for OFO later on. [1] - https://github.com/anchore/sbom-action#basic-usage |
Oh, interesting. I think you're right based on the doc. Your plan sounds good. |
Updated the PR. I validated the workflow in a test project - Release artefcats [1] & Image scan [2]. Let's see the workflow in action once merged 🤞 [1] - https://github.com/Kavindu-Dodan/flagd-grpc-sync/releases/tag/v0.6 |
Kavindu-Dodan
force-pushed
the
feature/sbom-to-release
branch
from
be4c676
to
32908ac
Compare
Kavindu-Dodan
force-pushed
the
feature/sbom-to-release
branch
from
32908ac
to
a371a80
Compare
Kavindu-Dodan
force-pushed
the
feature/sbom-to-release
branch
from
1af7e69
to
cbf500e
Compare
Signed-off-by: Kavindu Dodanduwa <kavindudodanduwa@gmail.com>
Signed-off-by: Kavindu Dodanduwa <kavindudodanduwa@gmail.com>
toddbaert
force-pushed
the
feature/sbom-to-release
branch
from
cbf500e
to
53a57a5
Compare
@Kavindu-Dodan has contributed multiple significant changes and proposals to flagd: - multiple refactors: #291, #307 - ci/security improvements: #338, #337 - architectural proposals (some of which got some attention from outside parties!): open-feature/ofep#45, open-feature/flagd-schemas#78, #249 (comment) - load testing: #225 - documentation improvements For these reasons, I believe he should be made a CODEOWNER in this repository. NOTE: before this is merged, @Kavindu-Dodan should be added with at least `maintainer` permissions to the repo. Signed-off-by: Todd Baert <toddbaert@gmail.com>
This PR
Fixes #329
Adding SBOM generation through go releaser. SBOM is generated per archive (see image for reference).
Along with the PR, changing deprecated archive naming [1]
How to test
Install goreleaser [2] and run following command tog get artefacts & sbom generates in local dist folder
goreleaser release --skip-publish --skip-validate --rm-dist[1] - https://goreleaser.com/deprecations/#archivesreplacements
[2] - https://goreleaser.com/install/