Adds sbom generation to gorelease action

uselagoon · Jan 28, 2025 · f246add · f246add
1 parent 84e7c53
commit f246add
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -46,6 +46,9 @@ jobs:
         echo "keyid:       ${{ steps.import_gpg.outputs.keyid }}"
         echo "name:        ${{ steps.import_gpg.outputs.name }}"
 
+    - uses: anchore/sbom-action/[email protected] # installs syft
+      name: Download syft
+
     - name: Build and Release
       uses: goreleaser/goreleaser-action@v2
       if: startsWith(github.ref, 'refs/tags/')

diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -28,3 +28,6 @@ changelog:
     exclude:
       - '^docs:'
       - '^test:'
+# SBOM configuration
+sboms:
+  - artifacts: archive