Skip to content

fix(build): include go package licenses in sbom fixes#2363 #2364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
migmartri merged 2 commits into from
Aug 18, 2025
Merged

fix(build): include go package licenses in sbom fixes#2363 #2364

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79a3b85
resolves chainloop-dev/chainloop#2022
kaysavps May 5, 2025
a32adff
fix(build): include go package licenses in sbom
kaysavps Aug 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,8 @@ jobs:

- name: Generate SBOMs, upload to release and attest
id: attest_goreleaser
env:
SYFT_GOLANG_SEARCH_REMOTE_LICENSES: "true"
run: |
# goreleaser output resides in dist/artifacts.json
# Attest all built containers and manifests
Expand Down
9 changes: 9 additions & 0 deletions docs/examples/contracts/sbom/sbom-quality.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
#release-contract
schemaVersion: v1
materials:
# SBOMs will be uploaded to your artifact registry and referenced by digest in the attestation
# Both SBOM_CYCLONEDX_JSON and SBOM_SPDX_JSON are supported
- type: SBOM_CYCLONEDX_JSON
name: sbom
policyGroups:
- ref: sbom-quality
11 changes: 11 additions & 0 deletions docs/examples/contracts/vulnerabilities/vulnerability-management.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
#vuln-scan-contract
schemaVersion: v1
materials:
# SCA scans will be uploaded to your artifact registry and referenced by digest in the attestation
# BLACKDUCK_SCA_JSON, SARIF, TWISTCLI_SCAN_JSON, GHAS_DEPENDENCY_SCAN
# are supported
- type: SARIF
name: vuln-scan
policyGroups:
- ref: vulnerability-management

Loading