Merge pull request #20 from depot/feat/sbom

README.md

@@ -106,6 +106,7 @@ The following inputs can be used as `step.with` keys and match the inputs from [
 | `provenance` | Bool/String | [Provenance](https://docs.docker.com/build/attestations/provenance/) is a shorthand for `--set=*.attest=type=provenance`                    |
 | `push`       | Bool        | Push is a shorthand for `--set=*.output=type=registry` (default `false`)                                                                    |
 | `sbom`       | Bool/String | [SBOM](https://docs.docker.com/build/attestations/sbom/) is a shorthand for `--set=*.attest=type=sbom`                                      |
+| `sbom-dir`   | String      | Save all image [SBOM](https://docs.docker.com/build/attestations/sbom/) to this output directory                                            |
 | `set`        | List        | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (eg: `targetpattern.key=value`) |
 
 ## Outputs

action.yml

@@ -51,6 +51,9 @@ inputs:
   sbom:
     description: 'SBOM is a shorthand for --set=*.attest=type=sbom'
     required: false
+  sbom-dir:
+    description: 'Directory to output SBOMs for each built image'
+    required: false
   set:
     description: 'List of targets values to override (eg. targetpattern.key=value)'
     required: false

dist/index.js

@@ -74337,6 +74337,7 @@ function getInputs() {
     provenance: getProvenanceInput(),
     push: core.getBooleanInput("push"),
     sbom: core.getInput("sbom"),
+    sbomDir: core.getInput("sbom-dir"),
     set: import_util.Util.getInputList("set", { ignoreComma: true, quote: false }),
     source: core.getInput("source"),
     project: core.getInput("project"),
@@ -76036,6 +76037,7 @@ async function bake(inputs) {
     ...flag("--load", inputs.load),
     ...flag("--push", inputs.push),
     ...flag("--sbom", inputs.sbom),
+    ...flag("--sbom-dir", inputs.sbomDir),
     ...flag("--set", inputs.set),
     ...flag("--push", inputs.push),
     ...flag("--set", inputs.set),

src/context.ts

@@ -18,6 +18,7 @@ export interface Inputs {
   provenance: string
   push: boolean
   sbom: string
+  sbomDir: string
   set: string[]
   source: string
   project: string
@@ -39,6 +40,7 @@ export function getInputs(): Inputs {
     provenance: getProvenanceInput(),
     push: core.getBooleanInput('push'),
     sbom: core.getInput('sbom'),
+    sbomDir: core.getInput('sbom-dir'),
     set: Util.getInputList('set', {ignoreComma: true, quote: false}),
     source: core.getInput('source'),
     project: core.getInput('project'),

src/depot.ts

@@ -63,6 +63,7 @@ export async function bake(inputs: Inputs) {
     ...flag('--load', inputs.load),
     ...flag('--push', inputs.push),
     ...flag('--sbom', inputs.sbom),
+    ...flag('--sbom-dir', inputs.sbomDir),
     ...flag('--set', inputs.set),
     ...flag('--push', inputs.push),
     ...flag('--set', inputs.set),