From 320d454e624e7ec387f24fc22bb6af8eb6e0b973 Mon Sep 17 00:00:00 2001 From: Declan Carroll Date: Tue, 9 Jun 2026 15:52:37 +0100 Subject: [PATCH] ci: Restore sbom: true to maintain OCI manifest index format (#31997) Co-authored-by: Claude Sonnet 4.6 (1M context) --- .github/workflows/docker-build-push.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml index 39620b3f22f..dc98b197e53 100644 --- a/.github/workflows/docker-build-push.yml +++ b/.github/workflows/docker-build-push.yml @@ -142,7 +142,7 @@ jobs: N8N_RELEASE_TYPE=${{ needs.determine-build-context.outputs.release_type }} platforms: ${{ matrix.docker_platform }} provenance: false # Disabled - using SLSA L3 generator for isolated provenance - sbom: false # Disabled - BuildKit's syft SBOM under-resolves npm licenses; the sbom-attestation job attests an enriched, license-gated CycloneDX SBOM instead + sbom: true push: ${{ inputs.force_gzip_compression != true && needs.determine-build-context.outputs.push_enabled == 'true' }} tags: ${{ steps.determine-tags.outputs.n8n_tags }} outputs: ${{ inputs.force_gzip_compression == true && format('type=image,push={0},compression=gzip,force-compression=true', needs.determine-build-context.outputs.push_enabled) || '' }} @@ -159,7 +159,7 @@ jobs: N8N_RELEASE_TYPE=${{ needs.determine-build-context.outputs.release_type }} platforms: ${{ matrix.docker_platform }} provenance: false # Disabled - using SLSA L3 generator for isolated provenance - sbom: false # Disabled - BuildKit's syft SBOM under-resolves npm licenses; the sbom-attestation job attests an enriched, license-gated CycloneDX SBOM instead + sbom: true push: ${{ inputs.force_gzip_compression != true && needs.determine-build-context.outputs.push_enabled == 'true' }} tags: ${{ steps.determine-tags.outputs.runners_tags }} outputs: ${{ inputs.force_gzip_compression == true && format('type=image,push={0},compression=gzip,force-compression=true', needs.determine-build-context.outputs.push_enabled) || '' }} @@ -176,7 +176,7 @@ jobs: N8N_RELEASE_TYPE=${{ needs.determine-build-context.outputs.release_type }} platforms: ${{ matrix.docker_platform }} provenance: false # Disabled - using SLSA L3 generator for isolated provenance - sbom: false # Disabled - BuildKit's syft SBOM under-resolves npm licenses; the sbom-attestation job attests an enriched, license-gated CycloneDX SBOM instead + sbom: true push: ${{ inputs.force_gzip_compression != true && needs.determine-build-context.outputs.push_enabled == 'true' }} tags: ${{ steps.determine-tags.outputs.runners_distroless_tags }} outputs: ${{ inputs.force_gzip_compression == true && format('type=image,push={0},compression=gzip,force-compression=true', needs.determine-build-context.outputs.push_enabled) || '' }}