Skip to content

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #34

feat: SBOM generation and OmniBOR build provenance (CRA compliance)

feat: SBOM generation and OmniBOR build provenance (CRA compliance) #34

Triggered via pull request July 23, 2026 02:34
Status Success
Total duration 4m 44s
Artifacts 5

sbom.yml

on: pull_request
gen-sbom unit tests
13s
gen-sbom unit tests
SBOM standalone (no autotools)
20s
SBOM standalone (no autotools)
SBOM integration (linux)
3m 43s
SBOM integration (linux)
SBOM integration (macos)
1m 24s
SBOM integration (macos)
bomsh integration (linux)
3m 12s
bomsh integration (linux)
Fit to window
Zoom out
Zoom in

Annotations

6 warnings
gen-sbom unit tests
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (macos)
The following taps are not trusted: aws/tap Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required. Untap them with: brew untap aws/tap Trust specific formulae, casks and commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> Whole-tap trust is broader and includes all current and future formulae, casks and commands from the listed taps. Trust whole taps with: brew trust aws/tap To disable trust checks: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release. For more information, see: https://docs.brew.sh/Tap-Trust
SBOM standalone (no autotools)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
SBOM integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
bomsh integration (linux)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
bomsh-omnibor-ecdd87798053be3234ac504499763871717e211c
988 KB
sha256:7596f0d2255f09aa71093c19e96d3bc71d729338b5ccd3be272fba26f52a83c4
bomsh-trace-diag-ecdd87798053be3234ac504499763871717e211c
130 KB
sha256:5152cfdbc59f02b501c610c97db1f9f68a9b717e23252aefc8aa3173ea73a395
sbom-integration-linux-ecdd87798053be3234ac504499763871717e211c
4.26 KB
sha256:17a468cafc00b51d7d86d190fe5bfcc11d56b3c83e3f687c7a37c4606281224a
sbom-integration-macos-ecdd87798053be3234ac504499763871717e211c
4.23 KB
sha256:5df9f3dffdb7d8eb7d0881af206a88149281daa1f74ca6dc082a97d0acf10b53
sbom-standalone-ecdd87798053be3234ac504499763871717e211c
19.8 KB
sha256:bd993e06dee90bd75e5d24a2bf401bb1f13abca1db683753afa6f39155c44191