Fix: mutable image reference in action.yml

.github/workflows/build.yaml

@@ -89,12 +89,28 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+      - name: Pin release image tag
+        # Rewrites the image reference in action.yml from the mutable :edge tag
+        # to the exact version tag being released, then moves the git tag to
+        # point at the new commit so consumers always get a pinned image.
+        if: github.event_name == 'release'
+        run: |
+          VERSION="${{ github.event.release.tag_name }}"
+          IMAGE_TAG="${VERSION#v}"
+          sed -i "s|image: 'docker://ghcr.io/${{ env.ORG }}/${{ env.IMAGE_NAME }}:.*'|image: 'docker://ghcr.io/${{ env.ORG }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}'|" action.yml
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add action.yml
+          git commit -m "chore: pin action.yml image to ${VERSION}"
+          git push origin HEAD:main
+          git tag -f "${VERSION}"
+          git push origin -f "${VERSION}"
       # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
       - name: Update dependency graph
         uses: advanced-security/maven-dependency-submission-action@v5
         if: github.event_name != 'pull_request'
       - name: Create CBOM
-        uses: cbomkit/cbomkit-action@v2.2.0
+        uses: cbomkit/cbomkit-action@main
         id: cbom
           # Persist CBOM after a job has completed and share
           # that CBOM with another job in the same workflow.

action.yml

@@ -13,4 +13,4 @@ outputs:
 
 runs:
   using: 'docker'
-  image: 'Dockerfile'
+  image: 'docker://ghcr.io/cbomkit/cbomkit-action:edge'

pom.xml

@@ -35,7 +35,7 @@
         <dependency>
             <groupId>org.pqca</groupId>
             <artifactId>cbomkit-lib</artifactId>
-            <version>1.1.0</version>
+            <version>1.2.1</version>
         </dependency>
     </dependencies>