Skip to content

ci: attest published image SBOMs - #48

Merged
xnoto merged 1 commit into
mainfrom
feat/image-sbom-attestations
Sep 12, 2026
Merged

xnoto merged 1 commit into
mainfrom
feat/image-sbom-attestations

Conversation

@xnoto

@xnoto xnoto commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

Summary

  • generate SPDX SBOMs from each published GHCR image digest
  • attach signed SBOM and build-provenance attestations after publishing
  • document the release-chain behavior

Validation

  • pre-commit run --all-files
  • YAML parse and workflow semantic assertions

No image publication occurs from this PR.

@xnoto
xnoto requested a review from a team as a code owner September 12, 2026 18:20
@github-actions

Copy link
Copy Markdown

Image CI passed

Pre-commit validation passed. View the workflow run.

@xnoto
xnoto merged commit b66c5e4 into main Sep 12, 2026
5 checks passed
@xnoto
xnoto deleted the feat/image-sbom-attestations branch September 12, 2026 18:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant