fix artefacts sbom

Author: ahmedmarzougui-enclaive

.github/workflows/build.yml

@@ -23,7 +23,6 @@ on:
 
 jobs:
 
-  # ── GET VERSION + TAG ─────────────────────────────────
   get-meta:
     runs-on: ubuntu-latest
     outputs:
@@ -74,9 +73,6 @@ jobs:
             && echo "webui=true" >> $GITHUB_OUTPUT \
             || echo "webui=false" >> $GITHUB_OUTPUT
 
-  #
-
-  # ── PROXY ─────────────────────────────────────────────
   build-proxy:
     needs: get-meta
     if: needs.get-meta.outputs.proxy_changed == 'true'
@@ -141,29 +137,27 @@ jobs:
           curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
             | sh -s -- -b /usr/local/bin
 
-  
       - name: Generate SBOM + attest proxy
         run: |
           echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
           chmod 600 /tmp/cosign.key
 
-          syft ${{ steps.build-proxy.outputs.digest }} -o spdx-json > /tmp/sbom.spdx.json
+          syft ${{ steps.build-proxy.outputs.digest }} -o spdx-json > /tmp/sbom-proxy.spdx.json
 
           COSIGN_PASSWORD="" cosign attest --yes \
             --key /tmp/cosign.key \
             --type spdxjson \
-            --predicate /tmp/sbom.spdx.json \
+            --predicate /tmp/sbom-proxy.spdx.json \
             ${{ steps.build-proxy.outputs.digest }}
 
-          rm /tmp/cosign.key /tmp/sbom.spdx.json
-
+          rm /tmp/cosign.key
 
       - name: Attest provenance proxy
         run: |
           echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
           chmod 600 /tmp/cosign.key
 
-          cat > /tmp/provenance.json << EOF
+          cat > /tmp/provenance-proxy.json << EOF
           {
             "buildType": "https://github.com/enclaive/garnet",
             "builder": {"id": "github-actions"},
@@ -179,12 +173,20 @@ jobs:
           COSIGN_PASSWORD="" cosign attest --yes \
             --key /tmp/cosign.key \
             --type slsaprovenance \
-            --predicate /tmp/provenance.json \
+            --predicate /tmp/provenance-proxy.json \
             ${{ steps.build-proxy.outputs.digest }}
 
-          rm /tmp/cosign.key /tmp/provenance.json
+          rm /tmp/cosign.key
+
+      - name: Upload SBOM + provenance artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: proxy-sbom-provenance-${{ needs.get-meta.outputs.revision }}
+          path: |
+            /tmp/sbom-proxy.spdx.json
+            /tmp/provenance-proxy.json
+          retention-days: 90
 
-  # ── PYTHON CHECKS (pip-audit, ruff, mypy, trivy, bandit) ──
   python-checks:
     needs: [get-meta, build-proxy]
     if: needs.get-meta.outputs.proxy_changed == 'true'
@@ -195,7 +197,6 @@ jobs:
       HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
       HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
 
-  # ── DEPLOY PROXY ──────────────────────────────────────
   deploy-proxy:
     needs: [get-meta, build-proxy, python-checks]
     if: needs.get-meta.outputs.proxy_changed == 'true'
@@ -222,7 +223,6 @@ jobs:
             docker exec garnet-privacy-proxy-1 python3 -c \
             'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/health\").read())'"
 
-  # ── RUN TESTS ─────────────────────────────────────────
   run-tests:
     needs: deploy-proxy
     if: needs.get-meta.outputs.proxy_changed == 'true'
@@ -231,7 +231,6 @@ jobs:
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
       CVM_HOST: ${{ secrets.CVM_HOST }}
 
-  # ── WEBUI ─────────────────────────────────────────────
   build-webui:
     needs: get-meta
     if: needs.get-meta.outputs.webui_changed == 'true'
@@ -291,7 +290,6 @@ jobs:
             ${{ steps.build-webui.outputs.digest }}
           rm /tmp/cosign.key
 
-   
       - name: Install Syft
         run: |
           curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \
@@ -302,22 +300,22 @@ jobs:
           echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
           chmod 600 /tmp/cosign.key
 
-          syft ${{ steps.build-webui.outputs.digest }} -o spdx-json > /tmp/sbom.spdx.json
+          syft ${{ steps.build-webui.outputs.digest }} -o spdx-json > /tmp/sbom-webui.spdx.json
 
           COSIGN_PASSWORD="" cosign attest --yes \
             --key /tmp/cosign.key \
             --type spdxjson \
-            --predicate /tmp/sbom.spdx.json \
+            --predicate /tmp/sbom-webui.spdx.json \
             ${{ steps.build-webui.outputs.digest }}
 
-          rm /tmp/cosign.key /tmp/sbom.spdx.json
+          rm /tmp/cosign.key
 
       - name: Attest provenance webui
         run: |
           echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
           chmod 600 /tmp/cosign.key
 
-          cat > /tmp/provenance.json << EOF
+          cat > /tmp/provenance-webui.json << EOF
           {
             "buildType": "https://github.com/enclaive/garnet",
             "builder": {"id": "github-actions"},
@@ -333,12 +331,20 @@ jobs:
           COSIGN_PASSWORD="" cosign attest --yes \
             --key /tmp/cosign.key \
             --type slsaprovenance \
-            --predicate /tmp/provenance.json \
+            --predicate /tmp/provenance-webui.json \
             ${{ steps.build-webui.outputs.digest }}
 
-          rm /tmp/cosign.key /tmp/provenance.json
+          rm /tmp/cosign.key
+
+      - name: Upload SBOM + provenance artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: webui-sbom-provenance-${{ needs.get-meta.outputs.revision }}
+          path: |
+            /tmp/sbom-webui.spdx.json
+            /tmp/provenance-webui.json
+          retention-days: 90
 
-  # ── DEPLOY WEBUI ──────────────────────────────────────
   deploy-webui:
     needs: [get-meta, build-webui]
     if: needs.get-meta.outputs.webui_changed == 'true'