Andreas/mtg_python_deckbuilder
1
0
Fork 0
mirror of https://github.com/mwisnowski/mtg_python_deckbuilder.git synced 2026-04-06 05:07:16 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

feat: add SBOM generation and build provenance attestation to release workflows (#69)

Browse source 
* feat: add SBOM generation and build provenance attestation to release workflows

* docs: update release notes template with SBOM unreleased entry
This commit is contained in:
mwisnowski 2026-04-02 10:44:13 -07:00 • committed by GitHub
parent 6d1d5a1822
commit 75184a5967
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 90 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

21
.github/workflows/github-release.yml vendored
View file

@ -56,6 +56,24 @@ jobs:
- name: Checkout
uses: actions/checkout@v5.0.0
- name: Generate source SBOM (SPDX)
uses: anchore/sbom-action@v0.24.0
with:
path: .
format: spdx-json
output-file: sbom-source.spdx.json
upload-artifact: false
upload-release-assets: false
- name: Generate source SBOM (CycloneDX)
uses: anchore/sbom-action@v0.24.0
with:
path: .
format: cyclonedx-json
output-file: sbom-source.cyclonedx.json
upload-artifact: false
upload-release-assets: false
- name: Prepare release notes
id: notes
shell: bash
@ -84,5 +102,8 @@ jobs:
tag_name: ${{ steps.notes.outputs.version }}
name: ${{ steps.notes.outputs.version }}
body_path: ${{ steps.notes.outputs.notes_file }}
files: |
sbom-source.spdx.json
sbom-source.cyclonedx.json
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}