diff --git a/.github/actions/apply-single-tags/action.yml b/.github/actions/apply-single-tags/action.yml index c374368f74..75cdc912b3 100644 --- a/.github/actions/apply-single-tags/action.yml +++ b/.github/actions/apply-single-tags/action.yml @@ -39,13 +39,6 @@ runs: --tags-dir /tmp/jupyter/tags/ shell: bash - - name: Upload SBOM for the image ๐Ÿงพ - uses: anchore/sbom-action@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10 - with: - image: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ inputs.image }} - artifact-name: ${{ inputs.image }}-${{ inputs.platform }}-${{ inputs.variant }}-sbom.spdx.json - upload-artifact-retention: 40 - # This step is needed to prevent pushing non-multi-arch "latest" tag - name: Remove the "latest" tag from the image ๐Ÿ—‘๏ธ run: docker image rmi ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ inputs.image }}:latest diff --git a/.github/workflows/docker-build-test-upload.yml b/.github/workflows/docker-build-test-upload.yml index 1b5c9c4bba..359bb41e3c 100644 --- a/.github/workflows/docker-build-test-upload.yml +++ b/.github/workflows/docker-build-test-upload.yml @@ -72,6 +72,7 @@ jobs: run: | docker build \ --rm --force-rm \ + --sbom true \ --tag ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ inputs.image }} \ images/${{ inputs.image }}/${{ inputs.variant != 'default' && inputs.variant || '.' }}/ \ --build-arg REGISTRY=${{ env.REGISTRY }} \