Andreas/mtg_python_deckbuilder
1
0
Fork 0
mirror of https://github.com/mwisnowski/mtg_python_deckbuilder.git synced 2026-04-05 12:47:17 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

feat: add SBOM generation and build provenance attestation to release workflows (#69)

Browse source 
* feat: add SBOM generation and build provenance attestation to release workflows

* docs: update release notes template with SBOM unreleased entry
This commit is contained in:
mwisnowski 2026-04-02 10:44:13 -07:00 • committed by GitHub
parent 6d1d5a1822
commit 75184a5967
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 90 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
README.md
View file

@ -34,6 +34,7 @@ A web-first Commander/EDH deckbuilder with a shared core for CLI, headless, and
- [Development setup](#development-setup)
- [Troubleshooting](#troubleshooting)
- [Contributing](#contributing)
- [Supply chain security](#supply-chain-security)
- [License & attribution](#license--attribution)
- [Further reading](#further-reading)
@ -446,6 +447,30 @@ Pull requests are welcome—follow the conventional commit style, keep diffs foc
---
## Supply chain security
Every tagged release includes SBOM (Software Bill of Materials) files attached to the GitHub Release assets:
| File | Format | Contents |
|------|--------|----------|
| `sbom-source.spdx.json` | SPDX 2.x JSON | Python dependency tree from source |
| `sbom-source.cyclonedx.json` | CycloneDX JSON | Python dependency tree from source |
| `sbom-image-vX.Y.Z.cyclonedx.json` | CycloneDX JSON | Full container image (OS + app) |
Build provenance attestations are published to the GitHub Attestations API for the multi-arch container image. To verify:
```bash
gh attestation verify oci://docker.io/mwisnowski/mtg-python-deckbuilder:latest \
--repo mwisnowski/mtg_python_deckbuilder
```
To inspect an SBOM locally (requires [Syft](https://github.com/anchore/syft)):
```bash
syft convert sbom-source.cyclonedx.json -o table
```
---
## License & attribution
Licensed under the [MIT License](LICENSE). Card data and imagery are provided by [Scryfall](https://scryfall.com); please respect their [API terms](https://scryfall.com/docs/api).