Skip to content

fix(ci): remove unverified Syft download in SBOM workflow #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weโ€™ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 7 commits into from
Mar 25, 2026
Merged

fix(ci): remove unverified Syft download in SBOM workflow #58

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
4460300
fix(ci): remove unverified syft binary download
seonghobae Mar 12, 2026
a41935b
fix(ci): disable implicit artifact uploads in sbom action
seonghobae Mar 25, 2026
f77f427
chore: trigger CodeRabbit review
seonghobae Mar 25, 2026
30f799b
Merge branch 'develop' into codex/fix-syft-ci-vulnerability-by-addingโ€ฆ
seonghobae Mar 25, 2026
c37ec24
Merge branch 'develop' into codex/fix-syft-ci-vulnerability-by-addingโ€ฆ
seonghobae Mar 25, 2026
6f706c5
trigger review
seonghobae Mar 25, 2026
83f414c
Merge branch 'develop' into codex/fix-syft-ci-vulnerability-by-addingโ€ฆ
seonghobae Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,14 +38,14 @@ jobs:
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install Syft
run: |
curl -sSfL -o "$RUNNER_TEMP/syft.tar.gz" "https://github.com/anchore/syft/releases/download/v1.20.0/syft_1.20.0_linux_amd64.tar.gz"
tar -xzf "$RUNNER_TEMP/syft.tar.gz" -C "$RUNNER_TEMP" syft

- name: Generate CycloneDX SBOM
run: |
"$RUNNER_TEMP/syft" dir:. -o cyclonedx-json=bandscope-sbom.cdx.json
uses: anchore/sbom-action@57aae528053a48a3f6235f2d9461b05fbcb7366d # v0.23.1
with:
path: .
format: cyclonedx-json
output-file: bandscope-sbom.cdx.json
Comment thread
coderabbitai[bot] marked this conversation as resolved.
upload-artifact: false
upload-release-assets: false

- name: Upload SBOM artifact
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
Expand Down
Loading