search

kubernetes-sigs / bom

A utility to generate SPDX-compliant Bill of Materials manifests
https://kubernetes-sigs.github.io/bom/
Apache License 2.0
331 stars 48 forks source link

Push to github release #439

Open puerco opened 4 months ago

puerco commented 4 months ago

What would you like to be added:

Given sufficient credentials and permissions (ie a GITHUB_TOKEN) we should add a flag to bom generate to push the resulting SBOM to a github release. For example

bom generate . --release-push[=[org/repo@]v1.0.2]

If nothing is specified, we can infer the org/repo and tag from the go import path and checking if the HEAD commit is tagged

Why is this needed:

This would simplify the CI workflows using bom and would also take care of other nagging smaller problems such as naming the SBOM correctly.

cpanato commented 4 months ago

/assign

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 1 week ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten