feat: SBOM generation and OmniBOR build provenance (CRA compliance) #19
sbom.yml
on: pull_request
gen-sbom unit tests
15s
SBOM standalone (no autotools)
20s
SBOM integration (linux)
5m 48s
SBOM integration (macos)
1m 31s
bomsh integration (linux)
3m 9s
Annotations
6 warnings
|
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
The following taps are not trusted:
aws/tap
azure/bicep
Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set.
This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first.
Enable trust checks now with:
export HOMEBREW_REQUIRE_TAP_TRUST=1
Trust specific formulae, casks or commands with:
brew trust --formula <user>/<tap>/<formula>
brew trust --cask <user>/<tap>/<cask>
brew trust --command <user>/<tap>/<command>
or trust installed formulae from these taps with:
brew trust --formula azure/bicep/bicep
You can trust all formulae, casks and commands from these taps with:
brew trust aws/tap azure/bicep
Prefer trusting only the specific formulae, casks or commands you need.
Untap them with:
brew untap aws/tap azure/bicep
To keep allowing them by default during the transition:
export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
This is not recommended and will be removed in a later release.
|
|
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
bomsh-omnibor-474e5543bb1be690936a72e28a322ac055679c94
|
943 KB |
sha256:fbb68c38b7733cdf300471fb1aa09a6bc188df6fe89acf37c8394e7c46d9613a
|
|
|
bomsh-trace-diag-474e5543bb1be690936a72e28a322ac055679c94
Expired
|
128 KB |
sha256:34229ffac5f0ff9afa0c4c630429633993efc5fdddba32e3ae3a2097e01e2929
|
|
|
sbom-integration-linux-474e5543bb1be690936a72e28a322ac055679c94
|
4.22 KB |
sha256:253c93737a644ffbf48f6c424adc66236546b17e1af1e309221ce9171f435313
|
|
|
sbom-integration-macos-474e5543bb1be690936a72e28a322ac055679c94
|
4.2 KB |
sha256:882542bcde772eb7aa793f3644405b157706304b29329b883e98532a4ad64472
|
|
|
sbom-standalone-474e5543bb1be690936a72e28a322ac055679c94
|
19.6 KB |
sha256:5b3a6208771e7b798dc99c169ed0a18a1b7d3e9c1320c75ebe4faa7ac7a4bcb8
|
|