Skip to content

Bump github.com/docker/docker from 27.2.1+incompatible to 27.3.0+incompatible #1265

Bump github.com/docker/docker from 27.2.1+incompatible to 27.3.0+incompatible

Bump github.com/docker/docker from 27.2.1+incompatible to 27.3.0+incompatible #1265

Workflow file for this run

name: Validate SBOMs
on:
pull_request:
branches:
- 'main'
env:
SPDX_TOOLS_VERSION: 1.1.0
jobs:
spdx:
name: Validate SPDX SBOM
runs-on: ubuntu-latest
env:
KO_DOCKER_REPO: localhost:1338
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version-file: 'go.mod'
check-latest: true
- uses: chainguard-dev/actions/setup-registry@main
- uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
- name: Install SPDX Tools
run: |
wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
unzip tools-java-${SPDX_TOOLS_VERSION}.zip
- name: Generate and Validate
run: |
cosign download sbom $(go run ./ build) | tee spdx.json
java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx.json
- uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
if: ${{ always() }}
with:
name: spdx.json
path: spdx.json
spdx-multi-arch:
name: Validate SPDX multi-arch SBOM
runs-on: ubuntu-latest
env:
KO_DOCKER_REPO: localhost:1338
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version-file: 'go.mod'
check-latest: true
- uses: chainguard-dev/actions/setup-registry@main
- uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
- name: Install SPDX Tools
run: |
wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
unzip tools-java-${SPDX_TOOLS_VERSION}.zip
- name: Generate and Validate
run: |
img=$(go run ./ build --platform=linux/amd64,linux/arm64)
cosign download sbom $img | tee spdx-multi-arch.json
java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx-multi-arch.json
- uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
if: ${{ always() }}
with:
name: spdx-multi-arch.json
path: spdx-multi-arch.json