attach attestation using cosign

fkie-cad · Dec 17, 2024 · 64bf655 · 64bf655
1 parent d409118
commit 64bf655
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -181,11 +181,12 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           DIGEST: ${{ steps.build-and-push.outputs.digest }}
 
-      - name: Add SBOM to container image
+      - name: Create SBOM of container image
         uses: anchore/sbom-action@v0
         with:
           image: ghcr.io/fkie-cad/logprep:py${{ matrix.python-version }}-${{ github.head_ref }}@${{ steps.build-and-push.outputs.digest }}
+          artifact-name: py${{ matrix.python-version }}-${{ github.head_ref }}.spdx.json
 
-      - uses: anchore/sbom-action/publish-sbom@v0
-        with:
-          sbom-artifact-match: ".*\\.spdx$"
+      - name: Attach SBOM attestation to image
+        run: |
+          cosign attach attestation --attestation py${{ matrix.python-version }}-${{ github.head_ref }}.spdx.json ghcr.io/fkie-cad/logprep:py${{ matrix.python-version }}-${{ github.head_ref }}@${{ steps.build-and-push.outputs.digest }}