feat: add SBOM generation and attestation to GitHub workflow

ThomasK33 · ThomasK33 · commit c7e6be17ad78 · 2025-04-07T14:13:28.000+02:00
Change-Id: I2e15d7322ddec933bbc9bd7880abba9b0842719f
Signed-off-by: Thomas Kosiewski &lt;tk@coder.com&gt;
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -496,6 +496,37 @@ jobs:
         env:
           CODER_BASE_IMAGE_TAG: ${{ steps.image-base-tag.outputs.tag }}
 
+      - name: SBOM Generation and Attestation
+        if: ${{ !inputs.dry_run }}
+        run: |
+          set -euxo pipefail
+          
+          # Generate SBOM for multi-arch image
+          echo "Generating SBOM for multi-arch image: ${{ steps.build_docker.outputs.multiarch_image }}"
+          syft "${{ steps.build_docker.outputs.multiarch_image }}" -o spdx-json > coder_sbom.spdx.json
+          
+          # Attest SBOM to multi-arch image
+          echo "Attesting SBOM to multi-arch image: ${{ steps.build_docker.outputs.multiarch_image }}"
+          COSIGN_EXPERIMENTAL=1 cosign clean "${{ steps.build_docker.outputs.multiarch_image }}"
+          COSIGN_EXPERIMENTAL=1 cosign attest --type spdxjson \
+            --predicate coder_sbom.spdx.json \
+            --yes \
+            "${{ steps.build_docker.outputs.multiarch_image }}"
+          
+          # If latest tag was created, also attest it
+          if [[ "${{ steps.build_docker.outputs.created_latest_tag }}" == "true" ]]; then
+            latest_tag="$(./scripts/image_tag.sh --version latest)"
+            echo "Generating SBOM for latest image: ${latest_tag}"
+            syft "${latest_tag}" -o spdx-json > coder_latest_sbom.spdx.json
+            
+            echo "Attesting SBOM to latest image: ${latest_tag}"
+            COSIGN_EXPERIMENTAL=1 cosign clean "${latest_tag}"
+            COSIGN_EXPERIMENTAL=1 cosign attest --type spdxjson \
+              --predicate coder_latest_sbom.spdx.json \
+              --yes \
+              "${latest_tag}"
+          fi
+
       - name: GitHub Attestation for Docker image
         id: attest_main
         if: ${{ !inputs.dry_run }}
diff --git a/scripts/build_docker.sh b/scripts/build_docker.sh
@@ -153,17 +153,6 @@ if [[ "$push" == 1 ]]; then
 	docker push "$image_tag" 1>&2
 fi
 
-log "--- Generating SBOM for Docker image ($image_tag)"
-syft "$image_tag" -o spdx-json >"${image_tag//[:\/]/_}.spdx.json"
-
-if [[ "$push" == 1 ]]; then
-	log "--- Attesting SBOM to Docker image for $arch ($image_tag)"
-	COSIGN_EXPERIMENTAL=1 cosign clean "$image_tag"
-
-	COSIGN_EXPERIMENTAL=1 cosign attest --type spdxjson \
-		--predicate "${image_tag//[:\/]/_}.spdx.json" \
-		--yes \
-		"$image_tag"
-fi
+# SBOM generation and attestation moved to the GitHub workflow
 
 echo "$image_tag"
