mirror of
https://github.com/shirou/gopsutil.git
synced 2025-05-14 19:29:16 +08:00
346f7bc0fd
It's important to make sure the SHA's are from the original repositories and not forks. For reference: https://github.com/actions/checkout/releases/tag/v3.5.28e5e7e5ab8https://github.com/advanced-security/sbom-generator-action/releases/tag/v0.0.1375dee8e61https://github.com/actions/upload-artifact/releases/tag/v3.1.20b7f8abb15Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
26 lines
598 B
YAML
26 lines
598 B
YAML
name: SBOM Generator
|
|
|
|
on:
|
|
push:
|
|
branches: [ "master" ]
|
|
|
|
workflow_dispatch:
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
|
|
|
|
- uses: advanced-security/sbom-generator-action@375dee8e6144d9fd0ec1f5667b4f6fb4faacefed # v0.0.1
|
|
id: sbom
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
|
|
with:
|
|
path: ${{steps.sbom.outputs.fileName }}
|
|
name: "SBOM"
|