diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 381d9e4..4e9e4e0 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -61,8 +61,7 @@ jobs: - name: Sign SBOM file run: | cosign sign-blob --yes \ - --output-certificate ${{ inputs.image-name }}-sbom-${{ matrix.arch }}.spdx.cert \ - --output-signature ${{ inputs.image-name }}-sbom-${{ matrix.arch }}.spdx.sig \ + --bundle ${{ inputs.image-name }}-sbom-${{ matrix.arch }}.spdx.bundle \ ${{ inputs.image-name }}-sbom-${{ matrix.arch }}.spdx - name: Attach SBOM file in the container image