Add support for different versions of CAPI bootstrap and infrastructu… #207
ebourgeoisbuild.yaml
on: push
🔐 Verify Signed Commits
6s
⚖️ Verify SPDX License Headers
6s
🧾 Validate VEX Statements
🔏 Validate Auto-VEX Sign-off
1m 44s
🛡️ Security Vulnerability Scan
22s
🏗️ IaC Security Scan (Trivy config)
23s
🧪 cargo-deny (License + Advisory + Sources)
24s
Matrix: ✍️ Sign Binary Artifacts
Matrix: docker
Matrix: grype-triage
Matrix: attest
Matrix: grype
🚀 Upload Release Assets
0s
Annotations
17 warnings
|
🛡️ Security Vulnerability Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🔏 Validate Auto-VEX Sign-off
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🦀 Build - Linux ARM64
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🦀 Build - Linux x86_64
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🏛️ Generate SLSA Provenance / detect-env
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v2.1.0. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🏛️ Generate SLSA Provenance / generator
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256, ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check, actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34, actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🏛️ Generate SLSA Provenance / generator
Restore cache failed: Dependencies file is not found in /home/runner/work/5-spot/5-spot. Supported file pattern: go.sum
|
|
🧪 Test
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🐳 Build and Push Docker Image - Chainguard
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Variables should be defined before their use:
Dockerfile.chainguard#L40
UndefinedVar: Usage of undefined variable '$BASE_IMAGE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
|
|
🐳 Build and Push Docker Image - Distroless
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🔏 Attest Docker Image - Distroless
Please check that the "artifact-metadata:write" permission has been included
|
|
🔏 Attest Docker Image - Distroless
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
|
|
🔏 Attest Docker Image - Chainguard
Please check that the "artifact-metadata:write" permission has been included
|
|
🔏 Attest Docker Image - Chainguard
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
|
|
🤖 Auto-VEX (reachability)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🤖 Auto-VEX (presence)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
0.0.0-main.2026-06-22.207.intoto.jsonl
Expired
|
10 KB |
sha256:705d9b53154b14daac6ad9f783511a4bf317210bf0583608d06873c288457206
|
|
|
5spot-linux-amd64
Expired
|
5.16 MB |
sha256:780fffc007818a7f369c1540867bf3cd72a6226e4f138bba4276fb2dce11919a
|
|
|
5spot-linux-amd64-signed
|
5.05 MB |
sha256:67464cbc47ebe31658b53514dc0196bf80060d242818c37c2a5ace3f5225f2cc
|
|
|
5spot-linux-arm64
Expired
|
4.97 MB |
sha256:7ebe299cf1e7e1dfdf4e9474e2593b4fc863b83a6b822b98dced5386f83cd270
|
|
|
5spot-linux-arm64-signed
|
4.77 MB |
sha256:f50a12738bd4779a1b009da30a7605442eefda84172a55345f3765a33593df68
|
|
|
cargo-audit-report
|
419 Bytes |
sha256:41f64d3ec4b0ff7400af79a53b3d3062733b08481243a72820b79d23db5b77d8
|
|
|
docker-sbom-Chainguard
|
106 KB |
sha256:35a14c5d8ac07f8c120fb063fbf4e91e678a6fe0cd1a1ac8a3dc67db98a98f75
|
|
|
docker-sbom-Distroless
|
106 KB |
sha256:44354059fc9e4345cfb6e5d63f03bd85d092c996b54e3c92247d7d3ae015b4e2
|
|
|
finos-5-spot_main-2026-06-22-distroless.cyclonedx.json
|
106 KB |
sha256:104b632a0981717a4fcd24594c50e90dbf091be25e58cf512a7e087b4094c89c
|
|
|
finos-5-spot_main-2026-06-22.cyclonedx.json
|
106 KB |
sha256:cd3696bbd1d1bf0cf1c77e6f62fef55821cf9d2c99c46b92c7e67df40544a67e
|
|
|
finos~5-spot~PMPX2T.dockerbuild
|
119 KB |
sha256:3cd0ecd517b738299feca7ed04cef4dcc05fc98e2d86d9b39e89e0c2e63d599b
|
|
|
finos~5-spot~ZQLMOQ.dockerbuild
|
78.5 KB |
sha256:3c6aece47a4b9215a205d75496bbfff6bac1650eb63edaab77c76c2f5b99842f
|
|
|
grype-push-Chainguard-207
|
3.69 KB |
sha256:b0107a569ec8d3513361641ddd9c63023843a663fdd96b65b36d659fb4b3e381
|
|
|
grype-push-Distroless-207
|
3.71 KB |
sha256:f2a4dce8f85e0ffa840663ee4e834433b5be08a7a21b16032165b964bf66d516
|
|
|
grype-triage-Chainguard
|
12.5 KB |
sha256:a9544902d2ad48eb3a10b68575b7814a27c953fefe20d60562712f0758deb93e
|
|
|
grype-triage-Distroless
|
12.5 KB |
sha256:3464107d23fa994dff0e60948634be1507748e84dc44f2a4a17c0cb727130924
|
|
|
openvex
|
1.44 KB |
sha256:e95ee0681846b08e01812d3aa795d056567353f0755deb7115fe51967870f6fd
|
|
|
vex-auto-presence
|
334 Bytes |
sha256:845445abc1ea17f4246c0e069a9b4b3c739282887370502807569f7f1b234320
|
|
|
vex-auto-reachability
|
744 Bytes |
sha256:440678a1e5f44cb51b61a8e5a020c4b9b2c6b91761954dc75c012c9e73d65f3a
|
|
|
vex-auto-reachability-evidence
|
1.2 KB |
sha256:cc42849efea5329d8ed67fa6c97ee74c0ee580a85fc54bcef1820d09c877ad2e
|
|