ci (release): Refactor the release workflow to properly accomodate sbom generation & to use advisory practices - #28

Open

turbobobbytraykov wants to merge 25 commits into

btraykov/supply-chain-provenance-sbom

Commits on Aug 24, 2026

Refactor release workflow with advisory practices
turbobobbytraykov
committed
57991a6
Include hidden files for hash verification as well
turbobobbytraykov
committed
8ee932f
re-use the gh env for the sign-assemblies job - for now
turbobobbytraykov
committed
d6600cb
explicitly create the sbom output dirs
turbobobbytraykov
committed
d28a2bb
drop the extra explicit shallow clone - it's already implicit
turbobobbytraykov
committed
ea3ea17
tweaks and security hardening
turbobobbytraykov
committed
63886c0

Commits on Aug 25, 2026

Try adding a pinned public snk for better verification and auditing
turbobobbytraykov
committed
6b9aaa6
tweaks
turbobobbytraykov
committed
9317613

Commits on Aug 26, 2026

Further refactoring and simplification
turbobobbytraykov
committed
3d7cff3
Fix the SBOM manifest dir
turbobobbytraykov
committed
b7c5817

Commits on Aug 27, 2026

Improve validations in the release workflow
turbobobbytraykov
committed
2ae96ce

Commits on Sep 1, 2026

Commits on Sep 2, 2026

Commits on Sep 3, 2026

Tweak author counting for CycloneDX SBOM and fixed path segment checking for the SPDX SBOM generation
turbobobbytraykov
committed
39eea93