Add SBOM Generation to Your GitHub Project with Syft

General
1

I just published a quick blog post about our sbom-action ! :partying_face:

Share and enjoy :pray:

2

I have this running on a personal project, but ran into an issue where it fails to upload the SBOM to the release artifacts.

--------------------- Attaching SBOMs to release: ‘v0.0.0’ ---------------------
[…]
Error: Resource not accessible by integration

Is there a config step missing to give the action permission to attach files to releases?

3

I didn’t RTFM. Looks like there are indeed permissions you need to set.

Working example: https://raw.githubusercontent.com/bigbrainenergy-org/web.tdl.app/refs/heads/main/.github/workflows/docker-publish.yml

Important bits:

jobs:
  build:
    permissions:
      actions: read
      contents: write
    steps:
1 Like
4

Hey @joshbuker – there is a section about permissions, today which says:

This action needs the following permissions, depending on how it is being used:

contents: write # for sbom-action artifact uploads

If attaching release assets, the actions: read permission is also required. This may be implicit for public repositories, but is likely to be necessary for private repositories.

actions: read # to find workflow artifacts when attaching release assets
1 Like