From e107d2a8ebd604b6365cabf26218fd3b1a38f1f5 Mon Sep 17 00:00:00 2001
From: Rolando Santamaria Maso <4096860+jkyberneees@users.noreply.github.com>
Date: Fri, 25 Sep 2026 09:08:36 +0200
Subject: [PATCH] fix(release): drop invalid sbom-action artifact input
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

anchore/sbom-action rejects 'artifact:' (valid name: 'artifact-name');
it fell back to directory-cataloging the whole release dir — which is
the better outcome, so remove the input and describe that behavior in
the step comment instead of renaming to single-artifact mode.
---
 .github/workflows/release.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e14e39..c59d431 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,15 +53,15 @@ jobs:
       - name: checksums
         run: sha256sum odek-* > checksums.txt
 
-      # SPDX SBOM of a representative build. All matrix entries compile the
-      # same source with the same go.mod, so the module set is identical;
-      # one SBOM covers the release. Upload handled by the release step so
-      # the SBOM ships signed like every other asset.
+      # SPDX SBOM of the whole release directory: all four binaries plus the
+      # go.mod dependency set in one document (sbom-action's directory-catalog
+      # default; the single-artifact input is invalid in v0.24.x). Upload
+      # handled by the release step so the SBOM ships signed like every other
+      # asset.
       - name: SBOM
         uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           format: spdx-json
-          artifact: odek-linux-amd64
           output-file: odek-${{ github.ref_name }}-sbom.spdx.json
           upload-artifact: false
           upload-release-assets: false