Skip to content

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #32

feat: SBOM generation and OmniBOR build provenance (CRA compliance)

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #32

Triggered via pull request July 21, 2026 19:16
Status Success
Total duration 8m 18s
Artifacts 5

sbom.yml

on: pull_request
gen-sbom unit tests
12s
gen-sbom unit tests
SBOM standalone (no autotools)
18s
SBOM standalone (no autotools)
SBOM integration (linux)
6m 4s
SBOM integration (linux)
SBOM integration (macos)
1m 28s
SBOM integration (macos)
bomsh integration (linux)
2m 50s
bomsh integration (linux)
Fit to window
Zoom out
Zoom in

Annotations

6 warnings
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
The following taps are not trusted: aws/tap Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required. Untap them with: brew untap aws/tap Trust specific formulae, casks and commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> Whole-tap trust is broader and includes all current and future formulae, casks and commands from the listed taps. Trust whole taps with: brew trust aws/tap To disable trust checks: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release. For more information, see: https://docs.brew.sh/Tap-Trust
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
bomsh-omnibor-8e5f0d9f623ff2a4c29d712637ab566f6cdf2520
1000 KB
sha256:f6863fed930b9fbc63a106e353cf3e129e21d91f2d51cee8d898c142e088df48
bomsh-trace-diag-8e5f0d9f623ff2a4c29d712637ab566f6cdf2520
143 KB
sha256:970df85065eecdd1193e595759025a2dc3aab9ac5faa1a6a5f74c4dcf9a56e28
sbom-integration-linux-8e5f0d9f623ff2a4c29d712637ab566f6cdf2520
4.25 KB
sha256:bd153af59f839bbb2445b1ec92c77ed878fd50fa0fd7300a423b959b8667c290
sbom-integration-macos-8e5f0d9f623ff2a4c29d712637ab566f6cdf2520
4.23 KB
sha256:8797535fce441b1716624388dde7cebd27134db9b1f5523e6984aed33c59379d
sbom-standalone-8e5f0d9f623ff2a4c29d712637ab566f6cdf2520
19.8 KB
sha256:823cc6ffc1b2b3023ae78a540294fcc57f3ecadb5fd01079dca209338c3fdb92