test: test sboms

Signed-off-by: Tiago Castro <tiagolobocastro@gmail.com>

Author: tiagolobocastro

.github/workflows/image-pr.yml

@@ -25,4 +25,7 @@ jobs:
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
       - name: Test building the release images
-        run: ./scripts/release.sh --skip-publish --build-bins
+        # SBOMs are generated here too so that a break in the SBOM path is caught
+        # pre-merge rather than on the develop push. Nothing is signed, since
+        # nothing is published.
+        run: ./scripts/release.sh --skip-publish --build-bins --sbom

.github/workflows/image.yml

@@ -4,6 +4,7 @@ on:
     branches:
       - develop
       - 'release/**'
+      - sbom
   workflow_call:
     inputs:
       tag:
@@ -35,6 +36,11 @@ jobs:
           # todo: once we support multi-arch builds
           #- ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+      # Required for cosign to get an OIDC token for keyless signing.
+      id-token: write
     steps:
       - uses: actions/checkout@v7
         with:
@@ -64,7 +70,14 @@ jobs:
       - name: Build and push the release images
         run: |
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            ./scripts/release.sh --tag ${{ inputs.tag }} --registry ${{ inputs.registry }}/${{ github.repository_owner }}/${{ inputs.namespace }}
+            ./scripts/release.sh --tag ${{ inputs.tag }} --registry ${{ inputs.registry }}/${{ github.repository_owner }}/${{ inputs.namespace }} --sbom --attest
           elif [[ "${{ github.event_name }}" == "push" ]]; then
-            ./scripts/release.sh
+            ./scripts/release.sh --registry docker.io/tiagolobocastro --sbom --attest
           fi
+      - name: Upload the SBOMs
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-${{ matrix.runner }}
+          path: sbom/*.json
+          if-no-files-found: warn

.gitignore

@@ -28,6 +28,7 @@ __pycache__
 /local-fio-0-verify.state
 /report.xml
 /docker-logs.txt
+/sbom/
 /.tmp
 /ci-report/
 pytest.log