Merge pull request #330 from uselagoon/bump-harbor-version #5

	name: tag to release
	on:
	push:
	tags:
	- v*
	permissions: {}
	jobs:
	release:
	permissions:
	# create release
	contents: write
	# required by attest-build-provenance
	id-token: write
	attestations: write
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.2.2
	with:
	fetch-depth: 0
	- name: Create release
	run: \|
	gh release create "${{ github.ref_name }}" --verify-tag --generate-notes
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	- name: Attach SBOM to release in SPDX JSON format
	# https://docs.github.com/en/rest/dependency-graph/sboms?apiVersion=2022-11-28
	run: \|
	gh api \
	-H "Accept: application/vnd.github+json" \
	-H "X-GitHub-Api-Version: 2022-11-28" \
	/repos/${{ github.repository }}/dependency-graph/sbom > sbom.spdx.json
	gh release upload "${{ github.ref_name }}" sbom.spdx.json
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	- uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
	with:
	subject-path: sbom.spdx.json

Provide feedback