Generate release SBOM with Syft

2026-07-30 02:25:07 +02:00
parent 7991b04b35
commit aa1e6e50c1
1 changed files with 4 additions and 1 deletions
@@ -35,7 +35,10 @@ jobs:
            --tag "$image" .
          docker push "$image"
          docker image inspect "$image" --format '{{index .RepoDigests 0}}' > image-digest.txt
-          docker sbom "$image" --format spdx-json > sbom.spdx.json
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            anchore/syft:v1.33.0 \
+            "docker:$image" -o spdx-json > sbom.spdx.json
          cat > RELEASE_NOTES.md <<EOF
          # VacatureRadar ${version}