Automatic SBOM

[varunsh-coder]

In the future harden-runner can upload SBOM generated during the workflow run to a central place. You can then access your security insights and SBOMs at the same place.

harden-runner monitors the GitHub-hosted runner and as a result could also generate an accurate SBOM automatically. You don't have to think about it or add steps for it.

Please discuss SBOM related stuff here.

@jauderho has created a sample workflow for key-less signing and SBOM generation here:
https://github.com/jauderho/dockerfiles/blob/main/.github/workflows/age.yml
https://github.com/jauderho/dockerfiles/actions/runs/1755633128

[dirien]

@varunsh-coder I like this idea very much!

[varunsh-coder]

@varunsh-coder I like this idea very much!

Thanks @dirien! Happy to see your comment!

To clarify, did you want to upload the SBOM that is already generated (e.g. using anchore/sbom-action) or wanted harden-runner to generate and upload the SBOM?

[jauderho]

Now tracking my findings here: jauderho/dockerfiles#149