add sboms

Signed-off-by: cpanato <ctadeu@gmail.com>
cpanato · Sep 30, 2022 · 213b873 · 213b873
1 parent 6621a07
commit 213b873
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 7 deletions.
diff --git a/.github/workflows/ci-goreleaser.yaml b/.github/workflows/ci-goreleaser.yaml
@@ -46,6 +46,9 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@v2
 
+      - name: Install syft
+        uses: anchore/sbom-action/download-syft@v0.12.0
+
       - name: Generate the sources
         run: make generate-sources
 

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -36,6 +36,9 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@v2
 
+      - name: Install syft
+        uses: anchore/sbom-action/download-syft@v0.12.0
+
       - name: Generate distribution sources
         run: make generate-sources
 

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -304,14 +304,11 @@ signs:
     certificate: "${artifact}.pem"
     cmd: cosign
     args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
-    artifacts: binary
-  - id: checksum
-    signature: "${artifact}.sig"
-    certificate: "${artifact}.pem"
-    cmd: cosign
-    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
-    artifacts: checksum
+    artifacts: all
 
 docker_signs:
   - artifacts: all
     args: [ "sign", "${artifact}" ]
+
+sboms:
+- artifacts: any