feat: SBOM generation and OmniBOR build provenance (CRA compliance) #25
MarkAtwoodsbom.yml
on: pull_request
gen-sbom unit tests
9s
SBOM standalone (no autotools)
22s
SBOM integration (linux)
6m 3s
SBOM integration (macos)
1m 15s
bomsh integration (linux)
3m 7s
Annotations
6 warnings and 1 notice
|
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
The following taps are not trusted:
aws/tap
Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required.
Untap them with:
brew untap aws/tap
Trust specific formulae, casks and commands with:
brew trust --formula <user>/<tap>/<formula>
brew trust --cask <user>/<tap>/<cask>
brew trust --command <user>/<tap>/<command>
Whole-tap trust is broader and includes all current and future formulae,
casks and commands from the listed taps. Trust whole taps with:
brew trust aws/tap
To disable trust checks:
export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
This is not recommended and will be removed in a later release.
For more information, see:
https://docs.brew.sh/Tap-Trust
|
|
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
SBOM integration (macos)
The macos-latest label will migrate to macOS 26 beginning June 15, 2026. For more information see https://github.com/actions/runner-images/issues/14167
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
bomsh-omnibor-6f0ddb632dc8f6402dcaf325211da59e3a1fa201
|
967 KB |
sha256:e727c5ccd653a7dd98a281d5eda78ea756e157281cb2a256056f5441fa0d2ffb
|
|
|
bomsh-trace-diag-6f0ddb632dc8f6402dcaf325211da59e3a1fa201
Expired
|
137 KB |
sha256:0248403ea681f8bb0b7db325356ce7e1948d5a3551c4fc2f077fbbce51b413b1
|
|
|
sbom-integration-linux-6f0ddb632dc8f6402dcaf325211da59e3a1fa201
|
4.26 KB |
sha256:78a01a7db8670deb4707676ca014b1d184a1372f2df50ccfbf6021cf45d4c7e6
|
|
|
sbom-integration-macos-6f0ddb632dc8f6402dcaf325211da59e3a1fa201
|
4.23 KB |
sha256:06496cc9136202c3d1d6ccb62d4f4ce0c06383c1100b9191b1951bdd393cc576
|
|
|
sbom-standalone-6f0ddb632dc8f6402dcaf325211da59e3a1fa201
|
19.8 KB |
sha256:477a74593aa7ee983e98ac9c528009d35effb3cf34f6ba5365d0c0eddd51d6df
|
|