Skip to content

feat(ci):create sbom generate and attest functions#643

Merged
bupd merged 4 commits into
goharbor:mainfrom
adityachopra29:feat/create-and-attach-sbom
Apr 7, 2026
Merged

feat(ci):create sbom generate and attest functions#643
bupd merged 4 commits into
goharbor:mainfrom
adityachopra29:feat/create-and-attach-sbom

Conversation

@adityachopra29

@adityachopra29 adityachopra29 commented Jan 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Overview

This pr fixes #229
The github actions ci is modified to

  1. Generate the sbom of the image using syft
  2. Attest the sbom using in-toto attestation done using cosign attestations
  • Dagger functions are created for each step which can be run indivisually as well.

Verifications

  • SBOM generation :
image

This show that the sbom is successfully generating using the syft command, and we can see the generated sbom in the sbom.spdx.json file

  • Cosign attestation of the generated sbom for the image :
image

This shows that the cosign command used to attest the sbom to the image is successful.

In the CI, we use the githubToken instead of verification using OTP, which is taken care of in the implementation

@codecov

codecov Bot commented Jan 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 7.45%. Comparing base (60ad0bd) to head (6627144).
⚠️ Report is 131 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff            @@
##             main    #643      +/-   ##
=========================================
- Coverage   10.99%   7.45%   -3.54%     
=========================================
  Files         173     261      +88     
  Lines        8671   12930    +4259     
=========================================
+ Hits          953     964      +11     
- Misses       7612   11857    +4245     
- Partials      106     109       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@adityachopra29

adityachopra29 commented Jan 24, 2026

Copy link
Copy Markdown
Contributor Author

@bupd @NucleoFusion This PR is ready for review. Please have a look :)

@bupd bupd requested a review from Copilot February 10, 2026 14:37
bupd
bupd approved these changes Feb 10, 2026
View reviewed changes

@bupd bupd left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

Copilot AI reviewed Feb 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds SBOM generation + in-toto attestation to the container image publish flow to address #229 (attach generated SBOMs to published images), implemented as reusable Dagger functions and wired into the existing publish-and-sign step.

Changes:

  • Generate an SPDX-JSON SBOM for each published image using Syft.
  • Attest the generated SBOM to the image using cosign attest (in-toto attestation).
  • Invoke SBOM generation + attestation as part of PublishImageAndSign.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .dagger/publishimage.go
Comment thread .dagger/publishimage.go Outdated
@adityachopra29

adityachopra29 commented Feb 15, 2026

Copy link
Copy Markdown
Contributor Author

I have made changes, waiting on the working of demo.goharbor.io to test

@adityachopra29 adityachopra29 force-pushed the feat/create-and-attach-sbom branch from 2ce1c3e to 88eda24 Compare February 17, 2026 14:27
@bupd

bupd commented Feb 17, 2026

Copy link
Copy Markdown
Member

@adityachopra29 please fix lint

@adityachopra29

adityachopra29 commented Feb 24, 2026

Copy link
Copy Markdown
Contributor Author

Yes, waiting on the issue #711 to get fixed. Several contributors have raised a PR for the same. Will rebase when the PR is merged

@adityachopra29 adityachopra29 force-pushed the feat/create-and-attach-sbom branch from 88eda24 to 3fabe95 Compare March 5, 2026 14:39
@adityachopra29
feat:create sbom generate and attest functions
e50b049 
Signed-off-by: Aditya Chopra <adityachopra2912@gmail.com>
@adityachopra29
fix
f5ec210 
Signed-off-by: Aditya Chopra <adityachopra2912@gmail.com>
@adityachopra29
fix:use env var for registry password
e65ab7c 
Signed-off-by: Aditya Chopra <adityachopra2912@gmail.com>
@adityachopra29
trigger
6627144 
Signed-off-by: Aditya Chopra <adityachopra2912@gmail.com>
@adityachopra29 adityachopra29 force-pushed the feat/create-and-attach-sbom branch from 3fabe95 to 6627144 Compare March 5, 2026 14:40
@adityachopra29

adityachopra29 commented Mar 5, 2026

Copy link
Copy Markdown
Contributor Author

@bupd @qcserestipy PTAL. I have rebased branch to updated ref

@bupd bupd merged commit 6a8c0d9 into goharbor:main Apr 7, 2026
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bupd bupd bupd approved these changes

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Create and Attach the generated SBOM to the Image

3 participants

@adityachopra29 @bupd