Add workflow code to generate SBOMs and upload them to the release/pre-release by jsf9k · Pull Request #266 · cisagov/skeleton-docker

jsf9k · 2026-01-20T19:34:58Z

🗣 Description

This pull request:

Adds workflow code to generate SBOMs for the Docker images
If we happen to be building a release or pre-release then the SBOMs will be uploaded to the release or pre-release.
Adds workflow code to create provenance attestations for the SBOMs and the Docker image artifact
Adds workflow code to create SBOM attestations for the Docker images

💭 Motivation and context

CISA advocates for the use of SBOMs, so we should be generating them for our software products.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All new and existing tests pass.

✅ Pre-merge checklist

Mark SBOM checks as required.

jsf9k · 2026-01-20T19:37:07Z

Note that the lint job should pass once SchemaStore/schemastore#5292 is merged and python-jsonschema/check-jsonschema#638 is resolved.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ions

Thus our SBOMs are named, e.g., cisagov-skeleton-docker.amd64.spdx-json rather than sbom.amd64.spdx-json.

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

The if statement is present to to keep the push and pull_request events from both causing the job to be run. Co-authored-by: dav3r <david.redmin@gwe.cisa.dhs.gov> Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

This was happening automatically before, but this makes it explicit. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

This reduces the chance that Docker Hub rate limits our request.

In this case we want to pull the image from Docker Hub.

Note that actions/attest-build-provenance has changed its name to actions/attest, partly because it now supports different types of attestations. One such type is an SBOM attestation, which we are now using here.

For more details see: https://github.com/actions/attest?tab=readme-ov-file#container-image

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

The subject path changed upstream, so it has to change here too.

felddy

Looks good... a step in the right direction.

This should scale well to us testing all the containers per architecture, and uploading attested SBOMs specific to each architecture.

mcdonnnj · 2026-04-24T18:38:13Z

+    #
+    # This if statement is present to keep the push and pull_request
+    # events from both causing the job to be run.
+    if: github.event_name != 'pull_request'


If we only care about doing this on release I think this job should only run if the push is for a tag.

Suggested change

if: github.event_name != 'pull_request'

if: startsWith(github.ref, 'refs/tags/')

mcdonnnj · 2026-04-24T18:38:39Z

+    # Generate an SBOM for the Docker image and, if there is a
+    # release, upload it as an asset to the release.


This comment doesn't seem accurate with what the job is actually doing.

mcdonnnj · 2026-04-24T18:40:53Z

We should add provenance: mode=max or sbom: true to the docker/build-push-action configuration in the build-push-all job to leverage built-in functionality while building the image.

jsf9k self-assigned this Jan 20, 2026

jsf9k added this to Next Kraken and Skeleton Maintenance Jan 20, 2026

github-project-automation Bot moved this to In progress in Skeleton Maintenance Jan 20, 2026

jsf9k moved this to In Progress in Next Kraken Jan 20, 2026

github-actions Bot added the github-actions Pull requests that update GitHub Actions code label Jan 20, 2026

jsf9k force-pushed the feature/add-sbom branch 12 times, most recently from 91e4cba to 516e839 Compare January 26, 2026 15:17

github-actions Bot added dependencies Pull requests that update a dependency file documentation This issue or pull request improves or adds to documentation version bump This issue or pull request increments the version number labels Jan 26, 2026

jsf9k force-pushed the feature/add-sbom branch from 481f4af to 9452d9a Compare January 26, 2026 18:37

jsf9k removed documentation This issue or pull request improves or adds to documentation version bump This issue or pull request increments the version number labels Jan 26, 2026

jsf9k marked this pull request as ready for review January 26, 2026 18:43

jsf9k requested review from dav3r, felddy and mcdonnnj as code owners January 26, 2026 18:43

jsf9k moved this from In progress to Review in progress in Skeleton Maintenance Jan 26, 2026

jsf9k force-pushed the feature/add-sbom branch 2 times, most recently from 9c2d344 to 3414b32 Compare March 10, 2026 14:30

dav3r approved these changes Mar 10, 2026

View reviewed changes

jsf9k force-pushed the feature/add-sbom branch 3 times, most recently from 7eb4b41 to ccf97fb Compare March 10, 2026 17:41

jsf9k requested a review from Copilot March 10, 2026 18:57

Copilot started reviewing on behalf of jsf9k March 10, 2026 18:57 View session

dav3r approved these changes Mar 10, 2026

View reviewed changes

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Outdated

jsf9k and others added 14 commits April 17, 2026 12:45

Add code to generate SBOMs and attach them to the release as assets

defbe26

Generate SBOMs for both the ARM64 and AMD64 architectures

5df4012

Add (commented out) Dependabot ignore directives for SBOM-related act…

41a5c9c

…ions

Manipulate the repo name and use that in the SBOM file name

26e3a75

Thus our SBOMs are named, e.g., cisagov-skeleton-docker.amd64.spdx-json rather than sbom.amd64.spdx-json.

Alphabetize

708f077

Co-authored-by: dav3r <david.redmin@trio.dhs.gov>

Make use of matrix.architecture to ensure the correct image is pulled

2a06a28

This was happening automatically before, but this makes it explicit. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Log into Docker Hub before pulling the image to generate the SBOM

1974378

This reduces the chance that Docker Hub rate limits our request.

Use the fully-qualified (including container repo) image name

cc5fdb8

In this case we want to pull the image from Docker Hub.

Upgrade to the latest name and version for the attestation action

dffcd02

Note that actions/attest-build-provenance has changed its name to actions/attest, partly because it now supports different types of attestations. One such type is an SBOM attestation, which we are now using here.

Update code to use the digest of the image upload

5bdfa22

For more details see: https://github.com/actions/attest?tab=readme-ov-file#container-image

Add provenance attestation for SBOM

9ae9720

Add provenance attestation for distribution

e59696b

Pare down permissions

9e38561

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

jsf9k force-pushed the feature/add-sbom branch from 0432fe7 to 9e38561 Compare April 17, 2026 16:56

Update subject path

e78c3ca

The subject path changed upstream, so it has to change here too.

felddy approved these changes Apr 17, 2026

View reviewed changes

github-project-automation Bot moved this from Review in progress to Reviewer approved in Skeleton Maintenance Apr 17, 2026

jsf9k requested a review from a team April 24, 2026 14:39

mcdonnnj reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add workflow code to generate SBOMs and upload them to the release/pre-release#266

Add workflow code to generate SBOMs and upload them to the release/pre-release#266
jsf9k wants to merge 15 commits intodevelopfrom
feature/add-sbom

jsf9k commented Jan 20, 2026 •

edited

Loading

Uh oh!

jsf9k commented Jan 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

felddy left a comment

Uh oh!

mcdonnnj Apr 24, 2026

Uh oh!

mcdonnnj Apr 24, 2026

Uh oh!

mcdonnnj Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	if: github.event_name != 'pull_request'
	if: startsWith(github.ref, 'refs/tags/')

		# Generate an SBOM for the Docker image and, if there is a
		# release, upload it as an asset to the release.

Conversation

jsf9k commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

✅ Pre-merge checklist

Uh oh!

jsf9k commented Jan 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

felddy left a comment

Choose a reason for hiding this comment

Uh oh!

mcdonnnj Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mcdonnnj Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mcdonnnj Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jsf9k commented Jan 20, 2026 •

edited

Loading