Skip to content

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #19

feat: SBOM generation and OmniBOR build provenance (CRA compliance)

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #19

Triggered via pull request June 18, 2026 10:15
Status Success
Total duration 7m 13s
Artifacts 5

sbom.yml

on: pull_request
gen-sbom unit tests
15s
gen-sbom unit tests
SBOM standalone (no autotools)
20s
SBOM standalone (no autotools)
SBOM integration (linux)
5m 48s
SBOM integration (linux)
SBOM integration (macos)
1m 31s
SBOM integration (macos)
bomsh integration (linux)
3m 9s
bomsh integration (linux)
Fit to window
Zoom out
Zoom in

Annotations

6 warnings
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
The following taps are not trusted: aws/tap azure/bicep Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set. This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first. Enable trust checks now with: export HOMEBREW_REQUIRE_TAP_TRUST=1 Trust specific formulae, casks or commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> or trust installed formulae from these taps with: brew trust --formula azure/bicep/bicep You can trust all formulae, casks and commands from these taps with: brew trust aws/tap azure/bicep Prefer trusting only the specific formulae, casks or commands you need. Untap them with: brew untap aws/tap azure/bicep To keep allowing them by default during the transition: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release.
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
bomsh-omnibor-474e5543bb1be690936a72e28a322ac055679c94
943 KB
sha256:fbb68c38b7733cdf300471fb1aa09a6bc188df6fe89acf37c8394e7c46d9613a
bomsh-trace-diag-474e5543bb1be690936a72e28a322ac055679c94 Expired
128 KB
sha256:34229ffac5f0ff9afa0c4c630429633993efc5fdddba32e3ae3a2097e01e2929
sbom-integration-linux-474e5543bb1be690936a72e28a322ac055679c94
4.22 KB
sha256:253c93737a644ffbf48f6c424adc66236546b17e1af1e309221ce9171f435313
sbom-integration-macos-474e5543bb1be690936a72e28a322ac055679c94
4.2 KB
sha256:882542bcde772eb7aa793f3644405b157706304b29329b883e98532a4ad64472
sbom-standalone-474e5543bb1be690936a72e28a322ac055679c94
19.6 KB
sha256:5b3a6208771e7b798dc99c169ed0a18a1b7d3e9c1320c75ebe4faa7ac7a4bcb8