ci: test sbom

Signed-off-by: r3drun3 <simone.ragonesi@sighup.io>
R3DRUN3 · Jan 15, 2024 · f07c715 · f07c715
1 parent deb1334
commit f07c715
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.github/workflows/patch.yaml b/.github/workflows/patch.yaml
@@ -76,6 +76,10 @@ jobs:
           id: push
           if: steps.login.conclusion == 'success'
           run: |
+            image_name="${{ steps.copa.outputs.patched-image }}"
+            sbom_file="${image_name}-SBOM.json"
+            docker sbom --format spdx-json --output "${sbom_file}" "${image_name}"
+            docker push ghcr.io/r3drun3/immunize/${ sbom_file }
             docker push ghcr.io/r3drun3/immunize/${{ steps.copa.outputs.patched-image }}
 
         - name: Sign image with Cosign