From 7dcf9d4ad9966a7bccf8a3f6ab686d50ab1c85ea Mon Sep 17 00:00:00 2001 From: Olivier Mehani Date: Tue, 7 Jul 2026 16:02:38 +1000 Subject: [PATCH 1/3] workflows: add sbom workflow (bug 2052763) --- .github/workflows/sbom.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/sbom.yml diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml new file mode 100644 index 0000000..6b9cdf1 --- /dev/null +++ b/.github/workflows/sbom.yml @@ -0,0 +1,16 @@ +name: ssdlc-sbom + +on: + release: + types: [published] + push: + branches: + - '*' + +permissions: {} #See guidance on how to set appropriate actions at workflow or job level + +jobs: + sbom: + uses: mozilla/ssdlc-actions/.github/workflows/ssdlc-sbom.yml@5cc2b20e42d53d1643853f12244fbec9ed2f2e0c + with: + sbom_name: ${{ github.event.release.tag_name || github.sha }} From bc9dd451aa8aaeb9119f4cb53d5d41f6b951dfa7 Mon Sep 17 00:00:00 2001 From: Olivier Mehani Date: Tue, 7 Jul 2026 16:03:50 +1000 Subject: [PATCH 2/3] dependabot: add github-actions (bug 2052763) --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 18fa96b..c4142ac 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,3 +11,7 @@ updates: open-pull-requests-limit: 99 allow: - dependency-type: all +- package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: monthly From 68e5158feecee059028fa5b1735181bbc8a4a6c1 Mon Sep 17 00:00:00 2001 From: Olivier Mehani Date: Tue, 7 Jul 2026 16:07:15 +1000 Subject: [PATCH 3/3] fixup! workflows: add sbom workflow (bug 2052763) --- .github/workflows/sbom.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 6b9cdf1..7b4c35a 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -3,9 +3,6 @@ name: ssdlc-sbom on: release: types: [published] - push: - branches: - - '*' permissions: {} #See guidance on how to set appropriate actions at workflow or job level