1

Author: mingcheng

.github/workflows/ghcr.yml

@@ -102,23 +102,16 @@ jobs:
 
       - name: Generate SBOM
         if: github.event_name != 'pull_request'
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0.20.8
         with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.push.outputs.digest }}
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.short-sha.outputs.sha }}
           format: spdx-json
           output-file: sbom.spdx.json
 
       - name: Upload SBOM as artifact
         if: github.event_name != 'pull_request'
         uses: actions/upload-artifact@v4
         with:
-          name: sbom-${{ github.sha }}
+          name: ${{ steps.short-sha.outputs.sha }}-sbom
           path: sbom.spdx.json
           retention-days: 90
-
-      - name: Image digest
-        if: github.event_name != 'pull_request'
-        run: |
-          echo "Image pushed successfully!"
-          echo "Digest: ${{ steps.push.outputs.digest }}"
-          echo "Tags: ${{ steps.meta.outputs.tags }}"