75 lines
2.6 KiB
YAML
75 lines
2.6 KiB
YAML
name: 'Attest SBOM'
|
|
description: 'Generate SBOM attestations for build artifacts'
|
|
author: 'GitHub'
|
|
branding:
|
|
color: 'blue'
|
|
icon: 'paperclip'
|
|
|
|
inputs:
|
|
subject-path:
|
|
description: >
|
|
Path to the artifact serving as the subject of the attestation. Must
|
|
specify exactly one of "subject-path" or "subject-digest". May contain a
|
|
glob pattern or list of paths (total subject count cannot exceed 2500).
|
|
required: false
|
|
subject-digest:
|
|
description: >
|
|
SHA256 digest of the subject for the attestation. Must be in the form
|
|
"sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one of
|
|
"subject-path" or "subject-digest".
|
|
required: false
|
|
subject-name:
|
|
description: >
|
|
Subject name as it should appear in the attestation. Required unless
|
|
"subject-path" is specified, in which case it will be inferred from the
|
|
path.
|
|
sbom-path:
|
|
description: >
|
|
Path to the JSON-formatted SBOM file to attest. File size cannot exceed
|
|
16MB.
|
|
required: true
|
|
push-to-registry:
|
|
description: >
|
|
Whether to push the provenance statement to the image registry. Requires
|
|
that the "subject-name" parameter specify the fully-qualified image name
|
|
and that the "subject-digest" parameter be specified. Defaults to false.
|
|
default: false
|
|
required: false
|
|
show-summary:
|
|
description: >
|
|
Whether to attach a list of generated attestations to the workflow run
|
|
summary page. Defaults to true.
|
|
default: true
|
|
required: false
|
|
github-token:
|
|
description: >
|
|
The GitHub token used to make authenticated API requests.
|
|
default: ${{ github.token }}
|
|
required: false
|
|
|
|
outputs:
|
|
bundle-path:
|
|
description: 'The path to the file containing the attestation bundle(s).'
|
|
value: ${{ steps.attest.outputs.bundle-path }}
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- uses: actions/attest-sbom/predicate@534423496eab34674190bc45fdacbb8b1198e07f # predicate@1.0.0
|
|
id: generate-sbom-predicate
|
|
with:
|
|
sbom-path: ${{ inputs.sbom-path }}
|
|
- uses: actions/attest@67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d # v1.4.1
|
|
id: attest
|
|
with:
|
|
subject-path: ${{ inputs.subject-path }}
|
|
subject-digest: ${{ inputs.subject-digest }}
|
|
subject-name: ${{ inputs.subject-name }}
|
|
predicate-type:
|
|
${{ steps.generate-sbom-predicate.outputs.predicate-type }}
|
|
predicate-path:
|
|
${{ steps.generate-sbom-predicate.outputs.predicate-path }}
|
|
push-to-registry: ${{ inputs.push-to-registry }}
|
|
show-summary: ${{ inputs.show-summary }}
|
|
github-token: ${{ inputs.github-token }}
|