chore: add sbom and provenance for docker build

Signed-off-by: Gaius <[email protected]>
dragonflyoss · Sep 18, 2024 · 1d58c7e · 1d58c7e
1 parent dffcf68
commit 1d58c7e
Showing 1 changed file with 2 additions and 8 deletions.
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -86,6 +86,8 @@ jobs:
         uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85
         with:
           context: .
+          sbom: true
+          provenance: true
           platforms: ${{ matrix.platforms }}
           file: build/images/${{ matrix.module }}/Dockerfile
           labels: |-
@@ -124,14 +126,6 @@ jobs:
         env:
           COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
 
-      - uses: anchore/sbom-action@v0
-        with:
-          image: dragonflyoss/${{ matrix.module }}:${{ steps.get_version.outputs.VERSION }}
-
-      - uses: anchore/sbom-action@v0
-        with:
-          image: ghcr.io/${{ env.IMAGE_REPOSITORY }}/${{ matrix.module }}:${{ steps.get_version.outputs.VERSION }}
-
       - name: Move cache
         run: |
           rm -rf /tmp/.buildx-cache