From ad2f7096325c9d04f1fd9cfb939c07497f690819 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Wed, 22 Apr 2026 21:00:38 -0700 Subject: [PATCH] fix: point SBOM generation at build/ not the zip MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit anchore/sbom-action treats its `path` input as a directory (it prepends `dir:` internally when invoking syft). Pointing it at `dist/github-token-broker.zip` failed because syft tried to scan the zip as if it were a directory and errored out. Scan `build/` instead — it contains just the `bootstrap` Go binary, which is exactly what we want the SBOM to describe. Syft resolves Go module dependencies directly from the binary's embedded build info. The subject of the SBOM attestation remains the zip (`dist/github-token-broker.zip`), which is correct — the attestation ties the SBOM predicate to the distributable artifact's digest. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/reusable-release.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/reusable-release.yml b/.github/workflows/reusable-release.yml index 530c411..e134038 100644 --- a/.github/workflows/reusable-release.yml +++ b/.github/workflows/reusable-release.yml @@ -57,9 +57,13 @@ jobs: cat checksums.txt - name: Generate SBOM + # anchore/sbom-action treats `path` as a directory (prefixed with + # dir: internally), so pointing it at the zip fails. Scan the + # build/ directory which contains just the bootstrap binary — + # syft resolves Go module dependencies directly from the binary. uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 with: - path: dist/github-token-broker.zip + path: build format: spdx-json output-file: dist/github-token-broker.zip.spdx.json upload-artifact: false