Sbom

.github/workflows/dockerimagerelease.yaml

@@ -49,6 +49,13 @@ jobs:
           docker tag $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:latest $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:latest
           docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:latest
 
+    - name: Generate SBOM
+        uses: anchore/[email protected]
+        with:
+          image: public.ecr.aws/t4s8c0c3/${{ inputs.image }}:latest
+          format: cyclonedx
+        id: anchore-sbom
+
       - uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
       - name: Sign the images
         run: |
@@ -65,4 +72,6 @@ jobs:
       - name: Attest SBOM
         run: |
           cosign attest \
-            --yes --predicate sbom-x86_64.spdx.json --type spdxjson public.ecr.aws/t4s8c0c3/${{ inputs.image }}:latest
+            --yes --predicate sbom-x86_64.spdx.json --type spdxjson public.ecr.aws/t4s8c0c3/${{ inputs.image }}:latest \
+            --certificate-identity https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com | jq