{"id":22685243,"url":"https://github.com/nais/salsa-action","last_synced_at":"2026-03-19T23:24:59.496Z","repository":{"id":98303759,"uuid":"608630807","full_name":"nais/salsa-action","owner":"nais","description":"Sign and attest images","archived":false,"fork":false,"pushed_at":"2024-03-20T16:37:21.000Z","size":243,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-12-09T22:13:38.341Z","etag":null,"topics":["slsa","supply","supply-chain-management"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nais.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-03-02T12:22:32.000Z","updated_at":"2023-03-08T14:10:03.000Z","dependencies_parsed_at":"2023-11-29T11:00:18.006Z","dependency_job_id":null,"html_url":"https://github.com/nais/salsa-action","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nais%2Fsalsa-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nais%2Fsalsa-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nais%2Fsalsa-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nais%2Fsalsa-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nais","download_url":"https://codeload.github.com/nais/salsa-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237148506,"owners_count":19262991,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["slsa","supply","supply-chain-management"],"created_at":"2024-12-09T22:13:50.384Z","updated_at":"2025-10-19T14:31:31.465Z","avatar_url":"https://github.com/nais.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# salsa-action\n\n🚧 🏗️ this project is an ealy development stage 🏗️ 🚧\n\n## Ecosystems\n\nAn ecosystem describes the tooling used to build a project. The following ecosystems bellow are supported to generate a\nSoftware Bill of Materials (SBOM).\n\nProject is not required to use any of the tools listed below.\nThe action will attempt to generate an SBOM using the trivy scanner for a project not requiring any of the tools listed\nbelow.\n\n### go\n\nThere are no pre-requisites for this ecosystem.\n\n### jvm\n\n* gradle\n\nProject must use gradle wrapper for the action to work.\n\n`$cyclonedxVersion` = [CycloneDX Gradle Releases](https://github.com/CycloneDX/cyclonedx-gradle-plugin/releases/)\n\nAdd plugin to your `build.gradle` or `build.gradle.kts` file:\n\n```groovy\nplugins {\n    id(\"org.cyclonedx.bom\") version $cyclonedxVersion\n}\n```\n\nNo further configuration is required.\n\nFor more information, see the [CycloneDX Gradle Plugin](https://github.com/CycloneDX/cyclonedx-gradle-plugin) project.\n\n* maven\n\nProject must use maven wrapper for the action to work.\n\n### Node\n\n* npm\n\nThere are no pre-requisites for this ecosystem.\n\n* yarn\n\nNot supported yet.\n\n### python\n\nThere are no pre-requisites for this ecosystem.\n\n## Attestation\n\n### Keys\n\n* KMS: [go-kms.yaml](.github/workflows/go-kms.yaml)\n* cosign.key: [go.yaml](.github/workflows/go.yaml)\n\n### Keyless\n\n* Google: [go-google.yaml](.github/workflows/go-google.yaml)\n* GitHub: [go-github.yaml](.github/workflows/go-github.yaml)\n\nRequires GitHub job permissions to be set.\n\n```yaml\njobs:\n  build:\n    permissions:\n      contents: 'read'\n      id-token: 'write'\n```\n\n## Configuration\n\nFor more information, see [action.yaml](action.yaml).\n\n# To Explore\n\n* Sign container image\n    * attest container sbom to container image\n* Support for other ecosystems\n* Support for other signing methods","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnais%2Fsalsa-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnais%2Fsalsa-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnais%2Fsalsa-action/lists"}