# Security & Releases

---

## SBOM

```bash
# SPDX format
dagger call generate-sbom-spdx --source=.

# CycloneDX format
dagger call generate-sbom-cyclone-dx --source=.
```

## Vulnerability Scanning

```bash
# Scan for CRITICAL and HIGH
dagger call scan-ci --source=.

# Custom severity
dagger call scan --source=. --severity="CRITICAL,HIGH,MEDIUM" --format="table"
```

## Supply Chain

- **SLSA Provenance** (Level 2) — generated by BuildKit during CI
- **Sigstore** — container images are signed
- **SBOM attestations** — embedded in registry manifests
- **OpenSSF Scorecard** — continuous security assessment

## Releasing

```bash
# Bump version, commit, tag, push
make release VERSION=0.9.0
```

This triggers:

1. `release.yml` — generates changelog with git-cliff, creates GitHub Release
2. `publish.yml` — builds and pushes Docker images (Alpine + Wolfi variants)