{"id":26796044,"url":"https://github.com/typisttech/upload-goreleaser-sboms-action","last_synced_at":"2025-03-29T18:17:07.098Z","repository":{"id":265161687,"uuid":"861491602","full_name":"typisttech/upload-goreleaser-sboms-action","owner":"typisttech","description":"Upload GoReleaser-generated SBOMs as an artifact","archived":false,"fork":false,"pushed_at":"2025-03-17T17:39:59.000Z","size":1800,"stargazers_count":1,"open_issues_count":2,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-03-22T05:32:32.001Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/typisttech.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-09-23T02:15:57.000Z","updated_at":"2025-01-18T01:23:44.000Z","dependencies_parsed_at":"2024-11-28T02:27:43.185Z","dependency_job_id":"aebb0ca8-363e-4a5f-835c-71a8ef7cdf78","html_url":"https://github.com/typisttech/upload-goreleaser-sboms-action","commit_stats":null,"previous_names":["typisttech/upload-goreleaser-sboms-action"],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/typisttech%2Fupload-goreleaser-sboms-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/typisttech%2Fupload-goreleaser-sboms-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/typisttech%2Fupload-goreleaser-sboms-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/typisttech%2Fupload-goreleaser-sboms-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/typisttech","download_url":"https://codeload.github.com/typisttech/upload-goreleaser-sboms-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246223319,"owners_count":20743168,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-03-29T18:17:06.489Z","updated_at":"2025-03-29T18:17:07.091Z","avatar_url":"https://github.com/typisttech.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# Upload GoReleaser SBOMs\n\n\u003c/div\u003e\n\n\u003cdiv align=\"center\"\u003e\n\n[![Check Transpiled JavaScript](https://github.com/typisttech/upload-goreleaser-sboms-action/actions/workflows/check-dist.yml/badge.svg)](https://github.com/typisttech/upload-goreleaser-sboms-action/actions/workflows/check-dist.yml)\n[![GitHub Release](https://img.shields.io/github/v/release/typisttech/upload-goreleaser-sboms-action?style=flat-square\u0026)](https://github.com/typisttech/upload-goreleaser-sboms-action/releases/latest)\n[![GitHub Marketplace](https://img.shields.io/badge/marketplace-upload--goreleaser--sbom-blue?logo=github\u0026style=flat-square)](https://github.com/marketplace/actions/upload-goreleaser-sboms)\n[![license](https://img.shields.io/github/license/typisttech/upload-goreleaser-sboms-action.svg?style=flat-square)](https://github.com/typisttech/upload-goreleaser-sboms-action/blob/master/LICENSE)\n[![X Follow @TangRufus](https://img.shields.io/badge/Follow-%40TangRufus-black?style=flat-square\u0026logo=x\u0026logoColor=white)](https://x.com/tangrufus)\n[![Hire Typist Tech](https://img.shields.io/badge/Hire-Typist%20Tech-ff69b4.svg?style=flat-square)](https://typist.tech/contact/)\n\n\u003c/div\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cstrong\u003eUpload GoReleaser-generated SBOMs as an artifact.\u003c/strong\u003e\n  \u003cbr /\u003e\n  \u003cbr /\u003e\n  Built with ♥ by \u003ca href=\"https://typist.tech/\"\u003eTypist Tech\u003c/a\u003e\n\u003c/p\u003e\n\n---\n\n## Usage\n\n### Inputs\n\n```yaml\n- uses: typisttech/upload-goreleaser-sboms-action@v0\n  with:\n    # Name of the artifact to upload.\n    # Required. Default is 'sboms'\n    name:\n\n    # Path to the dist folder which containing artifacts.json\n    # Required. Default is 'dist'\n    dist:\n\n    # The SBOM suffix.\n    #\n    # This action expects the SBOM is named after its subject with a suffix under the same directory.\n    # See [known issues](https://github.com/typisttech/upload-goreleaser-sboms-action?tab=readme-ov-file#known-issues)\n    # \n    # Required. Default is '.sbom.json'\n    sbom-suffix:\n\n    # Duration after which artifact will expire in days. 0 means using default retention.\n    # Minimum 1 day.\n    # Maximum 90 days unless changed from the repository settings page.\n    # Required. Defaults to repository settings.\n    retention-days:\n\n    # The level of compression for Zlib to be applied to the artifact archive.\n    # The value can range from 0 to 9.\n    # For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.\n    # Required. Default is '6'\n    compression-level:\n```\n\n### Outputs\n\n| Name | Description | Example |\n| - | - | - |\n| `attestations` | Array of **subject** and **sbom** paris. | `[{\"subject\":\"dist/foo\",\"sbom\":\"dist/foo.sbom.json\"},{\"subject\":\"dist/bar\",\"sbom\":\"dist/bar.sbom.json\"}]` |\n| `artifact-id` | GitHub ID of an Artifact. This ID can be used as input to other APIs to download, delete or get more information about an artifact: [https://docs.github.com/en/rest/actions/artifacts](https://docs.github.com/en/rest/actions/artifacts) | `1234` |\n\n## Examples\n\n### Basic\n\n```yaml\njobs:\n  release:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      sbom-artifact-id: ${{ steps.upload-sbom.outputs.artifact-id }}\n      sbom-attestations: ${{ steps.upload-sbom.outputs.attestations }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n      - uses: actions/setup-go@v5\n        with:\n          go-version-file: 'go.mod'\n      - uses: anchore/sbom-action/download-syft@v0\n      - uses: goreleaser/goreleaser-action@v6\n        with:\n          version: '~\u003e v2'\n          args: release --clean\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n      # This action!\n      - uses: typisttech/upload-goreleaser-sboms-action@v0\n        id: upload-sbom\n\n  attest-sbom:\n    needs: [release]\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      attestations: write\n    strategy:\n      matrix:\n        attestation: ${{ fromJSON(needs.release.outputs.sbom-attestations) }}\n    steps:\n      - uses: actions/download-artifact@v4\n        with:\n          name: 'sboms'\n      - uses: actions/attest-sbom@v1\n        with:\n          subject-path: ${{ matrix.attestation.subject }}\n          sbom-path: ${{ matrix.attestation.sbom }}\n```\n\n### Attest Build Provenance and SBOMs \u0026 Verify \u0026 Cleanup\n\n```yaml\non:\n  push:\n    tags:\n      - '*'\n\npermissions: {}\n\njobs:\n  release:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      build-provenance-artifact-id: ${{ steps.upload-build-provenance.outputs.artifact-id }}\n      sbom-artifact-id: ${{ steps.upload-sbom.outputs.artifact-id }}\n      sbom-attestations: ${{ steps.upload-sbom.outputs.attestations }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          fetch-depth: 0\n      - uses: actions/setup-go@v5\n        with:\n          go-version-file: 'go.mod'\n      - uses: anchore/sbom-action/download-syft@v0\n      - uses: goreleaser/goreleaser-action@v6\n        with:\n          version: '~\u003e v2'\n          args: release --clean\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n      - uses: actions/upload-artifact@v4\n        id: upload-build-provenance\n        with:\n          name: build-provenance\n          path: |\n            dist/my-cmd_*/my-cmd\n            dist/my-cmd_*.tar.gz\n            dist/**/*.sbom.json\n\n      # This action!\n      - uses: typisttech/upload-goreleaser-sboms-action@v0\n        id: upload-sbom\n        with:\n          name: sbom-artifact\n\n  attest-build-provenance:\n    needs: [release]\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      attestations: write\n    steps:\n      - uses: actions/download-artifact@v4\n        with:\n          path: dist\n          name: build-provenance\n      - uses: actions/attest-build-provenance@v1\n        with:\n          subject-path: |\n            dist/my-cmd_*/my-cmd\n            dist/my-cmd_*.tar.gz\n            dist/**/*.sbom.json\n\n  attest-sbom:\n    needs: [release]\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      attestations: write\n    strategy:\n      matrix:\n        attestation: ${{ fromJSON(needs.release.outputs.sbom-attestations) }}\n    steps:\n      - uses: actions/download-artifact@v4\n        with:\n          name: sbom-artifact\n      - uses: actions/attest-sbom@v1\n        with:\n          subject-path: ${{ matrix.attestation.subject }}\n          sbom-path: ${{ matrix.attestation.sbom }}\n\n  verify:\n    needs: [release, attest-build-provenance, attest-sbom]\n    runs-on: ubuntu-latest\n    steps:\n      - run: gh release download --clobber --dir artifacts --repo $REPO $TAG\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          REPO: ${{ github.repository }}\n          TAG: ${{ github.ref_name }}\n      - run: tree artifacts\n      - run: ls | xargs -I {} gh attestation verify --repo $REPO {}\n        working-directory: artifacts\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          REPO: ${{ github.repository }}\n\n  cleanup:\n    needs: [release, verify]\n    runs-on: ubuntu-latest\n    permissions:\n      actions: write\n    steps:\n      - run: \u003e\n          gh api --method DELETE -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /repos/$REPO/actions/artifacts/$ARTIFACT_ID\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          REPO: ${{ github.repository }}\n          ARTIFACT_ID: ${{ needs.release.outputs.build-provenance-artifact-id }}\n      - run: \u003e\n          gh api --method DELETE -H \"Accept: application/vnd.github+json\" -H \"X-GitHub-Api-Version: 2022-11-28\" /repos/$REPO/actions/artifacts/$ARTIFACT_ID\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          REPO: ${{ github.repository }}\n          ARTIFACT_ID: ${{ needs.release.outputs.sbom-artifact-id }}\n```\n\n## Known Issues\n\n### SBOM Suffix\n\nThis action expects the SBOM is named after its subject with a suffix under the same directory.\n\nFor example:\n\n```console\n$ tree dist\ndist\n├── artifacts.json\n├── my-cmd_1.2.3_darwin_amd64.tar.gz\n├── my-cmd_1.2.3_darwin_amd64.tar.gz.sbom.json\n├── my-cmd_1.2.3_linux_arm64.tar.gz\n└── my-cmd_1.2.3_linux_arm64.tar.gz.sbom.json\n```\n\n## Credits\n\n[Upload GoReleaser SBOMs](https://github.com/typisttech/upload-goreleaser-sboms-action) is a [Typist Tech](https://typist.tech) project and maintained by [Tang Rufus](https://x.com/TangRufus), freelance developer for [hire](https://typist.tech/contact/).\n\nFull list of contributors can be found [here](https://github.com/typisttech/upload-goreleaser-sboms-action/graphs/contributors).\n\n## Copyright and License\n\nThis project is a [free software](https://www.gnu.org/philosophy/free-sw.en.html) distributed under the terms of the MIT license. For the full license, see [LICENSE](./LICENSE).\n\n## Contribute\n\nFeedbacks / bug reports / pull requests are welcome.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftypisttech%2Fupload-goreleaser-sboms-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftypisttech%2Fupload-goreleaser-sboms-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftypisttech%2Fupload-goreleaser-sboms-action/lists"}