Add SBOMS generated as artifacts in "canary" build #43343
Labels
area:CI
Airflow's tests and continious integration
area:dev-env
CI, pre-commit, pylint and other changes that do not change the behavior of the final code
Currently, we have "sbom" generation done as part of the release. But it does not happen when "canary" build is executed in main. And @raboof - the Security Response engineer from the ASF is now building automation and exposure of the SBOMs for all ASF projects, so they are interested in being able to retrieve SBOMS from our main build automatically.
We should restore #41931 "Publish docs" scheme and add "update-sbom" command to include SBOM generation from main - so that it can be published in our test site. It should be as easy as running single command during doc publishing and likely fixing it so that it works with main constraints rather than only with released versions.
This is basically the command run to generted SBOM (and here support for
main
should be added if it does not work:The actual step in release process for that is https://github.com/apache/airflow/blob/main/dev/README_RELEASE_AIRFLOW.md#publish-documentation
The text was updated successfully, but these errors were encountered: