feat: SBOM generation and OmniBOR build provenance (CRA compliance) #18
sbom.yml
on: pull_request
gen-sbom unit tests
12s
SBOM standalone (no autotools)
19s
SBOM integration (linux)
5m 32s
SBOM integration (macos)
56s
bomsh integration (linux)
2m 53s
Annotations
6 warnings
|
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
The following taps are not trusted:
aws/tap
azure/bicep
Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set.
This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first.
Enable trust checks now with:
export HOMEBREW_REQUIRE_TAP_TRUST=1
Trust specific formulae, casks or commands with:
brew trust --formula <user>/<tap>/<formula>
brew trust --cask <user>/<tap>/<cask>
brew trust --command <user>/<tap>/<command>
or trust installed formulae from these taps with:
brew trust --formula azure/bicep/bicep
You can trust all formulae, casks and commands from these taps with:
brew trust aws/tap azure/bicep
Prefer trusting only the specific formulae, casks or commands you need.
Untap them with:
brew untap aws/tap azure/bicep
To keep allowing them by default during the transition:
export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
This is not recommended and will be removed in a later release.
|
|
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
bomsh-omnibor-39d06d447c3a409b5698b438a8eeff44ffc898c1
|
940 KB |
sha256:0f50b1bf4b9dcef2e86476aa39d7cefc4093d5eb0d8690d0eca98f7a0d79219d
|
|
|
bomsh-trace-diag-39d06d447c3a409b5698b438a8eeff44ffc898c1
Expired
|
128 KB |
sha256:858b932fa0f72f9b12e375766a8b4e9a941b1f0780603d4ba74c63f0fa0e8ae0
|
|
|
sbom-integration-linux-39d06d447c3a409b5698b438a8eeff44ffc898c1
|
4.23 KB |
sha256:942a4fd3cf3a63bcaebc6f9d3ab64aebd742542e11bc6b463c1766557e1c8a49
|
|
|
sbom-integration-macos-39d06d447c3a409b5698b438a8eeff44ffc898c1
|
4.2 KB |
sha256:4d4d3712ef1d874498ca50dff868291671449a38bb334aa3e9121a85253dfe2a
|
|
|
sbom-standalone-39d06d447c3a409b5698b438a8eeff44ffc898c1
|
19.6 KB |
sha256:29bafa4a6163b7cae67f500a37cbf2412df6cb75a68ca0ba03714ef987ea2b58
|
|