fix: enable SBOM generation and correct artifact verification docs - #108
Merged
hbraswelrh merged 1 commit intoAug 21, 2026
Merged
Conversation
The goreleaser config lacked an sboms block, so the reusable workflow's Syft-based SBOM generation was dormant. The README documented cosign verification, but the pipeline produces SLSA build provenance attestations. Closes gemaraproj#107 Assisted-by: Claude (Anthropic, Claude Opus 4.6) Signed-off-by: Jennifer Power <barnabei.jennifer@gmail.com>
Contributor
Author
|
@hbraswelrh Can you please take a look? |
slegarraga
approved these changes
Aug 7, 2026
slegarraga
left a comment
slegarraga
left a comment
Contributor
There was a problem hiding this comment.
This matches the issue's proposed solution: the sboms block enables Syft SPDX generation for archives, and the README now describes the actual attestation model with gh attestation verify instead of the cosign command that would not work. The diff stays scoped to release config and verification docs. Looks good to me.
Contributor
Author
|
@hbraswelrh Can you please take a look? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The goreleaser config lacked an sboms block, so the reusable workflow's Syft-based SBOM generation was dormant. The README documented cosign verification, but the pipeline produces SLSA build provenance attestations.
Closes #107
Assisted-by: Claude (Anthropic, Claude Opus 4.6)