docs: notes for matrix and required permissions

Signed-off-by: Keith Zantow <kzantow@gmail.com>
anchore · May 23, 2024 · 94b949f · 94b949f
1 parent 07e5b3a
commit 94b949f
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -116,6 +116,20 @@ use the `artifact-name` parameter:
     artifact-name: sbom.spdx
 ```
 
+> [!IMPORTANT]  
+> If using this action within a **matrix build**, you must specify a unique `artifact-name`
+> based on matrix parameters or the artifact upload will fail due to duplicate names. See
+> an [example here](.github/workflows/test.yml#L36).
+
+## Permissions
+
+This action needs the following permissions:
+
+```
+contents: write # for sbom-action artifact uploads
+actions: read # for sbom-action attaching release assets
+```
+
 ## Configuration
 
 ### anchore/sbom-action