Add Software Bill Of Materials to release

.github/workflows/build-and-sign-image.yml

@@ -3,22 +3,18 @@
 name: Build and sign image
 
 on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - "main"
-
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build_and_sign_image:
-    if: ${{ github.event.pull_request.merged }}
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       packages: write
       id-token: write
       security-events: write
@@ -27,6 +23,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - uses: anchore/sbom-action@v0
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          output-file: ./nginx-loadbalancer-kubernetes-${{env.GITHUB_REF_NAME}}.spdx.json
+          registry-username: ${{ github.actor }}
+          registry-password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Install cosign
         uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 #v3.0.2
         with:
@@ -79,3 +82,17 @@ jobs:
           sarif_file: 'trivy-results-${{ inputs.image }}.sarif'
           sha: ${{ github.sha }}
           ref: ${{ github.ref }}
+
+      - name: Generate Release
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: |
+            trivy-results-${{ inputs.image }}.sarif
+            ./nginx-loadbalancer-kubernetes-${{env.GITHUB_REF_NAME}}.spdx.json
+          body: |
+            # Release ${{env.GITHUB_REF_NAME}}
+            ## Changelog
+            ${{ steps.meta.outputs.changelog }}
+          generateReleaseNotes: true
+          makeLatest: false
+          name: "${{env.GITHUB_REF_NAME}}"

.github/workflows/build-test.yml → .github/workflows/run-tests.yml

@@ -1,11 +1,17 @@
 # This workflow will build a golang project
 # For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
 
-name: CI
+name: Run tests
 
 on:
+  branch_protection_rule:
+    types:
+      - created
+
   push:
-    branches: [ "main", "*" ]
+    branches:
+      - main
+      - *
 
 jobs: