actions-marketplace-validations/yewnorosen-test

something-something

Trust Signals

workflow.ymlSHA-pinned

uses: actions-marketplace-validations/leflambeur_rkvst-sbom@80fcd9848953873b026e1b6ef99098cedfb4eed3 # no releases — HEAD as of 2026-07-10

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
command	Event Type	yes	release
asset_id	RKVST Asset Identity (assets/{{UUID}})	yes	—
attrs	Core Event Attributes	yes	{"name": "${{ github.repository }}", "description": "${{ github.event.release.tag_name }} - ${{ github.repository }}", "hash": "${{ github.sha }}", "version": "${{ github.event.release.tag_name }}", "author": "${{ github.actor }}", "supplier": "${{ github.repository_owner }}", "uuid": "${{ github.repository }}"}
attachments	Array of build artifacts to attach to event	yes	[]
custom_attrs	Additional Event Attributes	no	{}
latest_sbom	Only for use with Release Event - used if uploaded sbom is not for latest version	no	{"name": "${{ github.repository }}", "description": "${{ github.event.release.tag_name }} - ${{ github.repository }}", "hash": "${{ github.sha }}", "version": "${{ github.event.release.tag_name }}", "author": "${{ github.actor }}", "supplier": "${{ github.repository_owner }}", "uuid": "${{ github.repository }}"}
custom_asset_attrs	Only for use with Release Event - Additional Asset Attributes	no	{}

no outputs