Skip to content

Commit 6e95f9d

Browse files
obezpalkoclaude
andcommitted
ci: replace anchore/sbom-action and attest-sbom with Node.js 24 alternatives
- anchore/sbom-action has no Node.js 24 version; replaced with direct syft install + run (same underlying tool, no JS runtime) - actions/attest-sbom is deprecated; replaced with actions/attest@v4 using predicate-type https://spdx.dev/Document Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent ed4ceef commit 6e95f9d

File tree

1 file changed

+6
-9
lines changed

1 file changed

+6
-9
lines changed

.github/workflows/docker.yml

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -135,20 +135,17 @@ jobs:
135135
echo "digest=$(crane digest "${primary_tag}")" >> "$GITHUB_OUTPUT"
136136
137137
- name: Generate SBOM
138-
uses: anchore/sbom-action@v0.23.1
139-
with:
140-
path: .
141-
output-file: sbom.spdx.json
142-
format: spdx-json
143-
upload-artifact: false
144-
upload-release-assets: false
138+
run: |
139+
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
140+
syft . -o spdx-json=sbom.spdx.json
145141
146142
- name: Attest SBOM
147-
uses: actions/attest-sbom@v4
143+
uses: actions/attest@v4
148144
with:
149145
subject-name: ${{ env.IMAGE }}
150146
subject-digest: ${{ steps.manifest.outputs.digest }}
151-
sbom-path: sbom.spdx.json
147+
predicate-type: https://spdx.dev/Document
148+
predicate: sbom.spdx.json
152149

153150
- name: Attest build provenance
154151
uses: actions/attest-build-provenance@v4

0 commit comments

Comments
 (0)