Update sbom.yml

Signed-off-by: Michael Kaufmann <5276337+wulfland@users.noreply.github.com>
wulfland · Oct 17, 2024 · 5d2dad3 · 5d2dad3
1 parent e042070
commit 5d2dad3
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
@@ -5,6 +5,10 @@ on: [workflow_dispatch]
 jobs:
   build:
     runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+      attestations: write
 
     steps:
     - name: Checkout Code
@@ -15,6 +19,12 @@ jobs:
       with:
         path: ./ch9_release/src/Tailwind.Traders.Web.sln
         github-bearer-token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Attest
+      uses: actions/attest-sbom@v1
+      with:
+        subject-path: './ch9_release/src/'
+        sbom-path: 'sbom.spdx.json'
 
     - name: Upload a Build Artifact
       uses: actions/upload-artifact@v4