From 9684f3f3577e529cc5ee1d0821092d20174852c2 Mon Sep 17 00:00:00 2001 From: Aaron Date: Sun, 30 Aug 2026 07:23:59 +0300 Subject: [PATCH 1/2] feat: add make target to upload SBOMs to GitHub releases Fixes #154 Signed-off-by: Aaron --- modules/oci-publish/01_mod.mk | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/modules/oci-publish/01_mod.mk b/modules/oci-publish/01_mod.mk index 348490c9..9bca1f16 100644 --- a/modules/oci-publish/01_mod.mk +++ b/modules/oci-publish/01_mod.mk @@ -124,4 +124,22 @@ $(foreach build_name,$(push_names),$(eval $(call oci_sign_target_per_image,$(bui ## Sign an OCI image. ## If a signature already exists, this will not overwrite it. ## @category [shared] Publish -$(oci_sign_targets): \ No newline at end of file +$(oci_sign_targets): + + +oci_sbom_upload_targets := $(push_names:%=oci-upload-sbom-%) + +.PHONY: $(oci_sbom_upload_targets) +## Upload SPDX SBOM files from oci-build to the current GitHub release. +## @category [shared] Publish +$(oci_sbom_upload_targets): oci-upload-sbom-%: oci-build-% | $(NEEDS_GH) + $(eval layout_path := $(oci_layout_path_$*)) + @if [ -d "$(CURDIR)/$(layout_path).sbom" ]; then \ + tag="$${GITHUB_REF_NAME:-$$(git describe --tags --exact-match 2>/dev/null)}"; \ + for f in "$(CURDIR)/$(layout_path).sbom"/*.spdx.json; do \ + [ -f "$$f" ] || continue; \ + $(GH) release upload "$$tag" "$$f" --clobber; \ + done; \ + else \ + echo "No SBOM directory at $(layout_path).sbom"; exit 1; \ + fi From 0bb75b3e33e4d94a180f0251f4d9b82899e28a3a Mon Sep 17 00:00:00 2001 From: Aaron Date: Sun, 30 Aug 2026 23:04:04 +0300 Subject: [PATCH 2/2] fix: use shell-local layout_path and fail on missing tag Signed-off-by: Aaron --- modules/oci-publish/01_mod.mk | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/oci-publish/01_mod.mk b/modules/oci-publish/01_mod.mk index 9bca1f16..9800a7ba 100644 --- a/modules/oci-publish/01_mod.mk +++ b/modules/oci-publish/01_mod.mk @@ -133,13 +133,16 @@ oci_sbom_upload_targets := $(push_names:%=oci-upload-sbom-%) ## Upload SPDX SBOM files from oci-build to the current GitHub release. ## @category [shared] Publish $(oci_sbom_upload_targets): oci-upload-sbom-%: oci-build-% | $(NEEDS_GH) - $(eval layout_path := $(oci_layout_path_$*)) - @if [ -d "$(CURDIR)/$(layout_path).sbom" ]; then \ + @layout_path='$(oci_layout_path_$*)'; \ + if [ -d "$(CURDIR)/$$layout_path.sbom" ]; then \ tag="$${GITHUB_REF_NAME:-$$(git describe --tags --exact-match 2>/dev/null)}"; \ - for f in "$(CURDIR)/$(layout_path).sbom"/*.spdx.json; do \ + if [ -z "$$tag" ]; then \ + echo "Could not determine release tag (set GITHUB_REF_NAME or run from a tagged commit)"; exit 1; \ + fi; \ + for f in "$(CURDIR)/$$layout_path.sbom"/*.spdx.json; do \ [ -f "$$f" ] || continue; \ $(GH) release upload "$$tag" "$$f" --clobber; \ done; \ else \ - echo "No SBOM directory at $(layout_path).sbom"; exit 1; \ + echo "No SBOM directory at $$layout_path.sbom"; exit 1; \ fi