Skip to content

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #18

feat: SBOM generation and OmniBOR build provenance (CRA compliance)

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #18

Triggered via pull request June 17, 2026 11:41
Status Success
Total duration 6m 47s
Artifacts 5

sbom.yml

on: pull_request
gen-sbom unit tests
12s
gen-sbom unit tests
SBOM standalone (no autotools)
19s
SBOM standalone (no autotools)
SBOM integration (linux)
5m 32s
SBOM integration (linux)
SBOM integration (macos)
56s
SBOM integration (macos)
bomsh integration (linux)
2m 53s
bomsh integration (linux)
Fit to window
Zoom out
Zoom in

Annotations

6 warnings
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
The following taps are not trusted: aws/tap azure/bicep Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set. This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first. Enable trust checks now with: export HOMEBREW_REQUIRE_TAP_TRUST=1 Trust specific formulae, casks or commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> or trust installed formulae from these taps with: brew trust --formula azure/bicep/bicep You can trust all formulae, casks and commands from these taps with: brew trust aws/tap azure/bicep Prefer trusting only the specific formulae, casks or commands you need. Untap them with: brew untap aws/tap azure/bicep To keep allowing them by default during the transition: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release.
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
bomsh-omnibor-39d06d447c3a409b5698b438a8eeff44ffc898c1
940 KB
sha256:0f50b1bf4b9dcef2e86476aa39d7cefc4093d5eb0d8690d0eca98f7a0d79219d
bomsh-trace-diag-39d06d447c3a409b5698b438a8eeff44ffc898c1 Expired
128 KB
sha256:858b932fa0f72f9b12e375766a8b4e9a941b1f0780603d4ba74c63f0fa0e8ae0
sbom-integration-linux-39d06d447c3a409b5698b438a8eeff44ffc898c1
4.23 KB
sha256:942a4fd3cf3a63bcaebc6f9d3ab64aebd742542e11bc6b463c1766557e1c8a49
sbom-integration-macos-39d06d447c3a409b5698b438a8eeff44ffc898c1
4.2 KB
sha256:4d4d3712ef1d874498ca50dff868291671449a38bb334aa3e9121a85253dfe2a
sbom-standalone-39d06d447c3a409b5698b438a8eeff44ffc898c1
19.6 KB
sha256:29bafa4a6163b7cae67f500a37cbf2412df6cb75a68ca0ba03714ef987ea2b58