Spaces:
Running
Running
| # Security & Releases | |
| --- | |
| ## SBOM | |
| ```bash | |
| # SPDX format | |
| dagger call generate-sbom-spdx --source=. | |
| # CycloneDX format | |
| dagger call generate-sbom-cyclone-dx --source=. | |
| ``` | |
| ## Vulnerability Scanning | |
| ```bash | |
| # Scan for CRITICAL and HIGH | |
| dagger call scan-ci --source=. | |
| # Custom severity | |
| dagger call scan --source=. --severity="CRITICAL,HIGH,MEDIUM" --format="table" | |
| ``` | |
| ## Supply Chain | |
| - **SLSA Provenance** (Level 2) — generated by BuildKit during CI | |
| - **Sigstore** — container images are signed | |
| - **SBOM attestations** — embedded in registry manifests | |
| - **OpenSSF Scorecard** — continuous security assessment | |
| ## Releasing | |
| ```bash | |
| # Bump version, commit, tag, push | |
| make release VERSION=0.9.0 | |
| ``` | |
| This triggers: | |
| 1. `release.yml` — generates changelog with git-cliff, creates GitHub Release | |
| 2. `publish.yml` — builds and pushes Docker images (Alpine + Wolfi variants) | |