Skip to content

Commit c9c8875

Browse files
Adding CycloneDX SBOM recording to release process (#485)
* Generate cyclone-dx json in build Amending the commit to for a new sha1 * Add cyclone SBOM recording --------- Co-authored-by: Sami Alajrami <sami@kosli.com>
1 parent aba249b commit c9c8875

File tree

1 file changed

+22
-1
lines changed

1 file changed

+22
-1
lines changed

.github/workflows/binary_provenance.yml

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,15 @@ jobs:
7272
output-file: '${{matrix.artifact.template_name}}-sbom.spdx.json'
7373
upload-artifact: false
7474
upload-release-assets: false
75+
76+
- name: Generate Cyclone-dx SBOM for the binary
77+
uses: anchore/sbom-action@v0
78+
with:
79+
file: ${{matrix.artifact.path}}
80+
format: 'cyclonedx-json'
81+
output-file: '${{matrix.artifact.template_name}}-sbom.cyclonedx.json'
82+
upload-artifact: false
83+
upload-release-assets: false
7584

7685
- name: Publish SBOM
7786
uses: anchore/sbom-action/publish-sbom@v0
@@ -104,7 +113,7 @@ jobs:
104113
--external-url sigstore=https://search.sigstore.dev/?hash=${{ env.FINGERPRINT }}
105114
--org ${{ inputs.kosli_org }}
106115

107-
- name: Report SBOM to Kosli
116+
- name: Report spdx SBOM attestation from sigstore to Kosli
108117
env:
109118
KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
110119
run:
@@ -117,6 +126,18 @@ jobs:
117126
--external-url sigstore=https://search.sigstore.dev/?logIndex=${{ env.SBOM_TLOG_INDEX }}
118127
--org ${{ inputs.kosli_org }}
119128

129+
- name: Report cyclonedx SBOM attestation from sigstore to Kosli
130+
env:
131+
KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
132+
run:
133+
kosli attest custom
134+
--flow ${{ inputs.flow_name }}
135+
--trail ${{ inputs.trail_name }}
136+
--name cyclone-dx-sbom
137+
--type cyclone-dx-1-6
138+
--fingerprint ${{ env.FINGERPRINT }}
139+
--attestation-data ${{matrix.artifact.template_name}}-sbom.cyclonedx.json
140+
--org ${{ inputs.kosli_org }}
120141

121142

122143

0 commit comments

Comments
 (0)