ci: enable sbom generation

martinnirtl · Apr 3, 2023 · b5877aa · b5877aa
1 parent c5185d1
commit b5877aa
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/.github/workflows/goreleaser.yaml b/.github/workflows/goreleaser.yaml
@@ -12,17 +12,19 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
       - id: setup-go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
         with:
           go-version-file: 'go.mod'
 
+      - uses: anchore/sbom-action/download-syft@422cb34a0f8b599678c41b21163ea6088edb2624 # v0.14.1
+
       - uses: goreleaser/goreleaser-action@v4
         with:
           distribution: goreleaser

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -59,8 +59,8 @@ archives:
 checksum:
   name_template: 'checksums.txt'
 
-# sboms:
-#   - artifacts: archive
+sboms:
+  - artifacts: archive
 
 snapshot:
   name_template: "{{ incpatch .Version }}-next"