bom.yaml

package:
  name: bom
  version: 0.6.0
  epoch: 11
  description: A utility to generate SPDX-compliant Bill of Materials manifests
  copyright:
    - license: Apache-2.0
  dependencies:
    runtime:
      - go

environment:
  environment:
    CGO_ENABLED: "0"

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/kubernetes-sigs/bom
      tag: v${{package.version}}
      expected-commit: 9be3ab721e914ad41141f302d6b5d0124a12cd1e

  - uses: go/bump
    with:
      deps: golang.org/x/net@v0.23.0 github.com/docker/docker@v26.1.5 golang.org/x/crypto@v0.31.0

  - uses: go/build
    with:
      packages: ./cmd/bom
      output: bom
      ldflags: -s -w -extldflags "-static"

  - uses: strip

update:
  enabled: true
  github:
    identifier: kubernetes-sigs/bom
    strip-prefix: v

test:
  pipeline:
    # AUTOGENERATED
    - runs: |
        bom --help
        bom version