feat: generate SBOMs for container images on release (#571)

Fixes #300
keptn · Jan 10, 2023 · 72fe001 · 72fe001
1 parent b482d96
commit 72fe001
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -100,6 +100,19 @@ jobs:
           COSIGN_EXPERIMENTAL: 1
         run: cosign sign ${{ env.IMAGE_TAG }}
 
+      - name: Generate SBOM
+        uses: anchore/[email protected]
+        with:
+          image: ${{ env.IMAGE_TAG }}
+          artifact-name: sbom-${{ matrix.config.name }}
+          output-file: ./sbom-${{ matrix.config.name }}.spdx.json
+
+      - name: Attach SBOM to release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ needs.release-please.outputs.tag_name }}
+          files: ./sbom-${{ matrix.config.name }}.spdx.json
+
   release-manifests:
     if: needs.release-please.outputs.releases_created == 'true'
     needs: