Upgrade: Bump anchore/sbom-action from 0.17.0 to 0.17.1

[dependabot]

Bumps anchore/sbom-action from 0.17.0 to 0.17.1.

Release notes

Sourced from anchore/sbom-action's releases.

v0.17.1

Changes in v0.17.1

• chore(deps): update Syft to v1.11.0 (#483) [anchore-actions-token-generator]

Commits

• ab9d16d chore(deps): update Syft to v1.11.0 (#483)
• fe5e7c3 doc: Updates for the Slack to Discourse migration (#484)
• f2d02cb chore: Create issue template (#481)
• ca15f99 docs: CODE_OF_CONDUCT.md (#480)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The provided code change updates the versions of dependencies used in the GitHub Actions workflow file .github/workflows/release.yaml to manage the release process of the application, and includes several security-focused features such as the use of Cosign for signing the release artifacts, the generation of a Software Bill of Materials (SBOM), and the execution of a verification script.

Expand for full summary

Summary:

The provided code change is from the GitHub Actions workflow file .github/workflows/release.yaml, which is responsible for managing the release process of the application. From an application security perspective, the changes are focused on updating the versions of the dependencies used in the workflow, such as the Syft and GoReleaser tools. This is a common practice to ensure the workflow is using the latest versions of the tools, which may include security fixes or improvements.

The workflow also includes several security-focused features, such as the use of Cosign for signing the release artifacts, the generation of a Software Bill of Materials (SBOM) using the Syft tool, and the execution of a verification script after the release process. These are all good security practices that help ensure the integrity and provenance of the released software. Additionally, the workflow is using the GITHUB_TOKEN secret to authenticate with GitHub during the release process, which requires proper management and protection to prevent unauthorized access and potential misuse.

Files Changed:

• .github/workflows/release.yaml: This file contains the GitHub Actions workflow responsible for managing the release process of the application. The changes include updating the versions of the sigstore/cosign-installer, anchore/sbom-action/download-syft, and goreleaser/goreleaser-action dependencies. The workflow also includes the installation of Cosign for signing the release artifacts, the generation of an SBOM using the Syft tool, and the execution of a verification script after the release process.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.