From 8d80118f60fd34575e1392ab7dacf9786d83e6bc Mon Sep 17 00:00:00 2001 From: san-zrl Date: Thu, 20 Aug 2026 14:07:54 +0200 Subject: [PATCH 1/3] Fix: mutable image reference in action.yml Signed-off-by: san-zrl --- .github/workflows/build.yaml | 18 +++++++++++++++++- Dockerfile | 3 --- action.yml | 2 +- 3 files changed, 18 insertions(+), 5 deletions(-) delete mode 100644 Dockerfile diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 2dfaacb..564162a 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -89,12 +89,28 @@ jobs: push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} + - name: Pin release image tag + # Rewrites the image reference in action.yml from the mutable :edge tag + # to the exact version tag being released, then moves the git tag to + # point at the new commit so consumers always get a pinned image. + if: github.event_name == 'release' + run: | + VERSION="${{ github.event.release.tag_name }}" + IMAGE_TAG="${VERSION#v}" + sed -i "s|image: 'docker://ghcr.io/${{ env.ORG }}/${{ env.IMAGE_NAME }}:.*'|image: 'docker://ghcr.io/${{ env.ORG }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}'|" action.yml + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git add action.yml + git commit -m "chore: pin action.yml image to ${VERSION}" + git push origin HEAD:main + git tag -f "${VERSION}" + git push origin -f "${VERSION}" # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive - name: Update dependency graph uses: advanced-security/maven-dependency-submission-action@v5 if: github.event_name != 'pull_request' - name: Create CBOM - uses: cbomkit/cbomkit-action@v2.2.0 + uses: cbomkit/cbomkit-action@${{ github.ref_name }} id: cbom # Persist CBOM after a job has completed and share # that CBOM with another job in the same workflow. diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index b601ba9..0000000 --- a/Dockerfile +++ /dev/null @@ -1,3 +0,0 @@ -# Default tag is edge. This will be overritten for each release -# and a dedicated release tag will be set. -FROM ghcr.io/cbomkit/cbomkit-action:edge diff --git a/action.yml b/action.yml index 0adc4f3..158a6b9 100644 --- a/action.yml +++ b/action.yml @@ -13,4 +13,4 @@ outputs: runs: using: 'docker' - image: 'Dockerfile' + image: 'docker://ghcr.io/cbomkit/cbomkit-action:edge' From 9ac8985ff6d1b606799ad448ce3cc4f9ca83f1a1 Mon Sep 17 00:00:00 2001 From: san-zrl Date: Thu, 20 Aug 2026 14:12:40 +0200 Subject: [PATCH 2/3] Update cbomkit-lib to 1.2.1 containing the temp dir fix Signed-off-by: san-zrl --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 986f5bd..28cbf4c 100644 --- a/pom.xml +++ b/pom.xml @@ -35,7 +35,7 @@ org.pqca cbomkit-lib - 1.1.0 + 1.2.1 From 8f4e8cee2d168a63655117b64a43cfcfb0aaa605 Mon Sep 17 00:00:00 2001 From: san-zrl Date: Thu, 20 Aug 2026 14:33:15 +0200 Subject: [PATCH 3/3] Build CBOM for this repo with latest version on main Signed-off-by: san-zrl --- .github/workflows/build.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 564162a..e6db563 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -110,7 +110,7 @@ jobs: uses: advanced-security/maven-dependency-submission-action@v5 if: github.event_name != 'pull_request' - name: Create CBOM - uses: cbomkit/cbomkit-action@${{ github.ref_name }} + uses: cbomkit/cbomkit-action@main id: cbom # Persist CBOM after a job has completed and share # that CBOM with another job in the same workflow.