Spaces:
Running
Running
File size: 886 Bytes
21488bd | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 | # Security & Releases
---
## SBOM
```bash
# SPDX format
dagger call generate-sbom-spdx --source=.
# CycloneDX format
dagger call generate-sbom-cyclone-dx --source=.
```
## Vulnerability Scanning
```bash
# Scan for CRITICAL and HIGH
dagger call scan-ci --source=.
# Custom severity
dagger call scan --source=. --severity="CRITICAL,HIGH,MEDIUM" --format="table"
```
## Supply Chain
- **SLSA Provenance** (Level 2) — generated by BuildKit during CI
- **Sigstore** — container images are signed
- **SBOM attestations** — embedded in registry manifests
- **OpenSSF Scorecard** — continuous security assessment
## Releasing
```bash
# Bump version, commit, tag, push
make release VERSION=0.9.0
```
This triggers:
1. `release.yml` — generates changelog with git-cliff, creates GitHub Release
2. `publish.yml` — builds and pushes Docker images (Alpine + Wolfi variants)
|