Skip to content

docs: say why GHA Scout compare disables SBOM on PRs #25852

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
locker95 wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −7
Open

docs: say why GHA Scout compare disables SBOM on PRs #25852

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions content/manuals/scout/integrations/ci/gha.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,14 +105,15 @@ This creates workflow steps to:

> [!NOTE]
>
> This CI workflow runs a local analysis and evaluation of your image. To
> evaluate the image locally, you must ensure that the image is loaded the
> local image store of your runner.
> The Scout compare step only runs on pull requests
> (`if: github.event_name == 'pull_request'`). Those builds set `load: true`
> and leave `sbom` / `provenance` off so the image can land in the runner's
> local store.
>
> This comparison doesn't work if you push the image to a registry, or if you
> build an image that can't be loaded to the runner's local image store. For
> example, multi-platform images or images with SBOM or provenance attestation
> can't be loaded to the local image store.
> On push events the same job turns SBOM and provenance on and `push`es to
> the registry. Don't enable those attestations (or a multi-platform build)
> on the PR path — those images can't be loaded locally, and compare would
> have nothing to inspect.

With this setup out of the way, you can add the following steps to run the
image comparison:
Expand Down