feat(helmBuild): generate SBOM on the publish path - #5856
Open
fabienfritz wants to merge 1 commit into
Open
Conversation
Contributor
Author
|
/it-go |
1 similar comment
Contributor
Author
|
/it-go |
fabienfritz
force-pushed
the
ffritz/helmBuild-add-sbom
branch
from
July 30, 2026 07:45
e95849e to
ec39ed3
Compare
Contributor
Author
|
/it-go |
fabienfritz
marked this pull request as ready for review
July 30, 2026 07:58
fskhiri
reviewed
Jul 30, 2026
fskhiri
left a comment
fskhiri
left a comment
Contributor
There was a problem hiding this comment.
No blocker, to findings worth look at it. Let me know what do you think ?
Contributor
Author
|
/it-go |
fabienfritz
force-pushed
the
ffritz/helmBuild-add-sbom
branch
from
August 5, 2026 13:25
d0f5815 to
2a4d98d
Compare
Contributor
Author
|
/it-go |
Contributor
Author
|
/it-go |
fabienfritz
force-pushed
the
ffritz/helmBuild-add-sbom
branch
from
August 7, 2026 07:48
f24ba99 to
5b1558a
Compare
Contributor
|
/it-go |
1 similar comment
Contributor
Author
|
/it-go |
fabienfritz
force-pushed
the
ffritz/helmBuild-add-sbom
branch
from
August 11, 2026 16:01
7d038a9 to
f6e6a0c
Compare
fabienfritz
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add CycloneDX SBOM Generation to
helmBuildStepDescription
helmBuild(formerlyhelmExecute) now generates CycloneDX 1.4 SBOMs when achart is published with
createBOM: true. SBOM generation runs only after asuccessful publish — a failed publish produces no artifact to describe.
Two SBOMs are produced, sharing a single discovered image set so they describe
the same images:
bom-helm.xml) — a chart-level BOM with apkg:helmPURL forthe published chart. Pure-Go, no network.
bom-docker-<N>.xml) — one per container image referencedby the chart, produced with Syft. Images are discovered by rendering the chart
(
helm template), falling back to thecontainerImageNameTagsCPE list.Both are best-effort: a failure is logged but never fails the step.
New step parameters
createBOM(bool, defaultfalse) — enable SBOM generation.syftDownloadUrl(string) — download URL of the Syft linux amd64 binary.containerImageNameTags([]string) — fallback image list, typically from anupstream
kanikoExecutestep (container/imageNameTagsCPE).Generated BOMs are collected via a
reportsoutput (**/bom-*.xml, typesbom).Refactoring
anchore/syft#1408, where Syft
omits the root component's PURL) is factored out of
kanikoExecuteintopiperutils.BuildRegistryFreeDockerPurl/ParsePurland shared by both steps.Tests
injection, and the shared piperutils helpers.
TestHelmIntegrationintegration test that runs a realhelmBuildpublishagainst a WebDAV sidecar and asserts
bom-helm.xmlis produced and passesCycloneDX 1.4 validation, with no container images (no Syft download).
Checklist
Tests
Documentation
Inner source library needs updating
🔄 Regenerate and Update Summary
PR Bot Information
Version:
1.29.676bc11a0-8b74-11f1-93c3-d9c03e937050issue_comment.edited