Skip to content

fix(release): drop invalid sbom-action artifact input #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jkyberneees merged 1 commit into from
Sep 25, 2026
Merged

fix(release): drop invalid sbom-action artifact input #266

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,15 +53,15 @@ jobs:
- name: checksums
run: sha256sum odek-* > checksums.txt

# SPDX SBOM of a representative build. All matrix entries compile the
# same source with the same go.mod, so the module set is identical;
# one SBOM covers the release. Upload handled by the release step so
# the SBOM ships signed like every other asset.
# SPDX SBOM of the whole release directory: all four binaries plus the
# go.mod dependency set in one document (sbom-action's directory-catalog
# default; the single-artifact input is invalid in v0.24.x). Upload
# handled by the release step so the SBOM ships signed like every other
# asset.
- name: SBOM
uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
with:
format: spdx-json
artifact: odek-linux-amd64
output-file: odek-${{ github.ref_name }}-sbom.spdx.json
upload-artifact: false
upload-release-assets: false
Expand Down
Loading