ci: generate sbom and prov for aikit and pre-made model images (#36)

Signed-off-by: Sertac Ozercan <[email protected]>
sozercan · Dec 13, 2023 · 2acbbb6 · 2acbbb6
1 parent f6ad4f9
commit 2acbbb6
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 0 deletions.
diff --git a/.github/workflows/pre-release.yaml b/.github/workflows/pre-release.yaml
@@ -51,6 +51,8 @@ jobs:
           tags: ghcr.io/sozercan/aikit:dev
           cache-from: type=gha,scope=aikit
           cache-to: type=gha,scope=aikit,mode=max
+          sbom: true
+          provenance: true
 
       - name: Sign the images with GitHub OIDC Token
         env:

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -60,6 +60,8 @@ jobs:
             ghcr.io/sozercan/aikit:latest
           cache-from: type=gha,scope=aikit
           cache-to: type=gha,scope=aikit,mode=max
+          sbom: true
+          provenance: true
 
       - name: Sign the images with GitHub OIDC Token
         env:

diff --git a/.github/workflows/update-models.yaml b/.github/workflows/update-models.yaml
@@ -61,6 +61,7 @@ jobs:
           docker buildx build . -t ghcr.io/sozercan/${MODEL_NAME}:${MODEL_SIZE}${MODEL_RUNTIME} \
             -f models/${{ matrix.model }}.yaml \
             --push --progress plain \
+            --sbom=true --provenance=true \
             --cache-from=type=gha,scope=${MODEL_NAME}-${MODEL_SIZE} \
             --cache-to=type=gha,scope=${MODEL_NAME}-${MODEL_SIZE},mode=max
           echo "DIGEST=$(cosign triangulate ghcr.io/sozercan/${MODEL_NAME}:${MODEL_SIZE}${MODEL_RUNTIME} --type digest)" >> $GITHUB_ENV