Unable to generate and package source.sbom.spdx.json

[stdedos]

I am trying to follow https://github.com/orgs/goreleaser/discussions/4425

---

Configuration:

stdedos/junit2html@5570a43#diff-7326b55c062b0f46fe9e39aace0a25f4515cf206040fb91a6fd2cae839f5e826R47-R50

Result:

https://github.com/stdedos/junit2html/actions/runs/9976707656/job/27569570578#step:7:54

I suspect

  • cataloging artifacts
    • no artifacts matching current filters

is the "outcome" of spdx-source?

---

Also, will it be possible to package source.sbom.spdx.json inside the artifacts?

It seems to me that the sbom pipeline runs after the artifacts pipeline. It looks impossible.

(Or: I don't understand what https://github.com/orgs/goreleaser/discussions/4425 is doing)

[caarlos0]

you need to enable source archives https://goreleaser.com/customization/source/

source:
  enabled: true

sboms:
  - artifacts: source

[stdedos]

Am I missing something, or is there a small reporting issue?

Every path in the execution log is reported as dist/..., except the source pipeline (here https://github.com/stdedos/junit2html/actions/runs/10072072067/job/27843322795#step:7:52)

PS: Also sbom=[...] paths have no dist/ prepended, but I think you write in the documentation that the sbom pipeline cdstodist/` - so maybe they are fine the way they are.

[caarlos0]

oh yeah, looks like it, gonna fix it real fast.

[caarlos0]

fixed on c9398ee