Security & Releases

SBOM

# SPDX format
dagger call generate-sbom-spdx --source=.

# CycloneDX format
dagger call generate-sbom-cyclone-dx --source=.

Vulnerability Scanning

# Scan for CRITICAL and HIGH
dagger call scan-ci --source=.

# Custom severity
dagger call scan --source=. --severity="CRITICAL,HIGH,MEDIUM" --format="table"

Supply Chain

• SLSA Provenance (Level 2) — generated by BuildKit during CI
• Sigstore — container images are signed
• SBOM attestations — embedded in registry manifests
• OpenSSF Scorecard — continuous security assessment

Releasing

# Bump version, commit, tag, push
make release VERSION=0.9.0

This triggers:

1. release.yml — generates changelog with git-cliff, creates GitHub Release
2. publish.yml — builds and pushes Docker images (Alpine + Wolfi variants)