Skip to content

SeeBOM 0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 May 22:14
v0.3.0
8f49067
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Container Images

All images are signed with cosign (keyless) and attested with SLSA provenance.

docker pull ghcr.io/seebom-labs/seebom/api-gateway:0.3.0
docker pull ghcr.io/seebom-labs/seebom/parsing-worker:0.3.0
docker pull ghcr.io/seebom-labs/seebom/ingestion-watcher:0.3.0
docker pull ghcr.io/seebom-labs/seebom/cve-refresher:0.3.0
docker pull ghcr.io/seebom-labs/seebom/ui:0.3.0

Verify signatures:

cosign verify --certificate-identity-regexp="https://github.com/seebom-labs/seebom" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/seebom-labs/seebom/api-gateway:0.3.0

Helm Chart

helm install seebom oci://ghcr.io/seebom-labs/seebom/charts/seebom --version 0.3.0

SBOM

An SPDX SBOM for this release is attached as seebom-0.3.0.spdx.json.

🚀 Features

Version Skew Detection Endpoint and UI (#37)

New feature to surface packages with inconsistent versions across projects, helping teams identify dependency drift and prioritize updates.

  • Backend: New endpoint GET /api/v1/stats/version-skew with server-side pagination and ILIKE search filter
  • Frontend: New /version-skew route with paginated table, expandable rows showing per-version project breakdown, and project links for drill-down
  • Debounced search input for package name filtering

In-Toto Attestation Envelope Support (#19)

The SPDX parser now supports in-toto attestation envelopes where the SPDX content is wrapped inside the predicate field (common with Syft/BuildKit-generated container SBOMs).

GitHub License Resolution

Extended the license scanner to resolve unknown licenses via the GitHub API, including 50+ well-known Go module→GitHub repo mappings.

S3 Credentials in Secrets

Added the option to provide S3 credentials via Kubernetes Secrets for secure SBOM bucket access.

🐛 Bug Fixes

  • fix: Show package names for permissive licenses in SBOM license breakdown (#66)
  • fix: InToto envelope parsing bugfix (#65)
  • fix: Dashboard number display formatting
  • fix: Ingestion pipeline stability improvements (#19)
  • fix: "Most used package by project" now shows real project names
  • fix: SBOM search fixed to return correct results
  • fix: Correct SHA hash for ossf/scorecard-action v2.4.3 (#102)
  • fix: Link to GOVERNANCE.md from feature template

🔒 Security

OpenSSF Scorecard Integration (#101)

  • Added Scorecard workflow (.github/workflows/scorecard.yml) for weekly supply-chain security assessment
  • Results published as SARIF to GitHub Security tab
  • Added OpenSSF badges to README

OpenSSF Baseline Compliance

  • Added CONTRIBUTING.md (required by baseline)
  • Added .github/dependabot.yml for automated dependency updates (Go, npm, Actions, Hugo)
  • Added .github/CODEOWNERS for required review enforcement
  • Added .github/workflows/codeql.yml for SAST scanning (Go + TypeScript)
  • Pinned ALL GitHub Actions to commit SHAs across all workflows

📖 Documentation

  • Add SEO improvements for docs.seebom.dev: robots.txt, Open Graph image, meta tags (#104)
  • Add OpenSSF badges section to README

🔧 Maintenance

Dependency Updates

  • github.com/ClickHouse/clickhouse-go/v2 bumped (3 updates)
  • github.com/minio/minio-go/v7 bumped (2 updates)
  • github.com/goccy/go-json bumped
  • @angular/cdk 21.2.1 → 21.2.7
  • @angular/cli 21.2.1 → 21.2.5
  • @angular/build 21.2.1 → 21.2.5
  • vitest 4.0.18 → 4.1.4
  • jsdom 28.1.0 → 29.0.2

GitHub Actions Updates

  • actions/checkout 4.2.2 → 6.0.2
  • actions/setup-go 5.5.0 → 6.4.0
  • actions/setup-node 4.4.0 → 6.4.0
  • actions/upload-artifact 4.6.0 → 7.0.1
  • actions/upload-pages-artifact 3.0.1 → 5.0.0
  • actions/deploy-pages 4.0.5 → 5.0.0
  • actions/configure-pages 5.0.0 → 6.0.0
  • actions/labeler 5.0.0 → 6.0.1
  • docker/login-action 3.4.0 → 4.1.0
  • docker/setup-buildx-action 3.10.0 → 4.0.0
  • github/codeql-action 3.28.16 → 4.35.1
  • softprops/action-gh-release 2.2.2 → 3.0.0
  • azure/setup-helm 4.3.0 → 5.0.0

📦 Upgrade Notes

  • The new /api/v1/stats/version-skew endpoint is available immediately — no migration needed (queries existing sbom_packages table).
  • If upgrading from v0.2.0, no schema migrations are required.
  • The in-toto support may surface additional packages from previously unparseable SBOMs. Consider running make re-ingest to re-process all SBOMs.

🙏 Contributors

Thanks to everyone who contributed to this release!

New Contributors

Full Changelog: v0.2.0...v0.3.0

Contributors

mfahlandt, arewm, and dependabot
Assets 3
Loading