mcc0nnell commented on PR #6777: URL: https://github.com/apache/camel-k/pull/6777#issuecomment-5431715727
Thanks for the review. I’ve pushed a follow-up addressing the three points. * Removed the Syft registry credentials; the images are public, so the SBOM scan now runs anonymously. * Centralized the assurance tool versions in script/release-assurance-tools.env and pinned CycloneDX, Syft, and Cosign to immutable commit SHAs. * Kept id-token: write intentionally because Cosign keyless signing needs the GitHub Actions OIDC token; I added a comment in the workflow to make that requirement explicit. I also removed the last duplicated hard-coded Syft version so the manifest is now the single source of truth. Thanks again. Those were good catches. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
