I think it would be great to name slsa-provenance-action somewhere which implements https://slsa.dev/provenance/v0.2.
Our own release workflow also shows how to use it, as well combine it with other concepts like codesigning (using cosign).
Soon we will also include SBOM in SPDX format.
I think it would be great to name slsa-provenance-action somewhere which implements https://slsa.dev/provenance/v0.2.
Our own release workflow also shows how to use it, as well combine it with other concepts like codesigning (using cosign).
Soon we will also include SBOM in SPDX format.