Zanie Blue b9abe15562 Add SBOM attestations to Docker images (#18252) ...

Adds SBOM attestations
https://docs.docker.com/build/metadata/attestations/sbom/

Requires https://github.com/rust-secure-code/cargo-auditable/pull/236
for our uv binaries and their dependencies to be included in the SBOM

You can inspect the SBOM with, e.g.:

```
docker buildx imagetools inspect ghcr.io/astral-sh/uv-dev:sha-ece6427 --format '{{json .SBOM}}' | jq
docker buildx imagetools inspect ghcr.io/astral-sh/uv-dev:sha-ece6427-python3.9-trixie --format '{{json .SBOM}}' | jq
```

Also explicitly sets
https://docs.docker.com/build/metadata/attestations/slsa-provenance/#max
but there appears to be no change as all of the max SLSA data is already
present.

2026-03-03 12:14:06 -06:00

..

bench.yml

Update CodSpeedHQ/action action to v4.10.6 (#18033)

2026-02-16 17:57:20 +01:00

build-dev-binaries.yml

Vendor mold installation and add more retries (#18271)

2026-03-03 11:59:58 -06:00

build-docker.yml

Add SBOM attestations to Docker images (#18252)

2026-03-03 12:14:06 -06:00

build-release-binaries.yml

Update maturin to v1.12.4 (#18236)

2026-03-01 20:54:48 -05:00

check-docs.yml

Update dependency astral-sh/uv to v0.10.7 (#18235)

2026-03-01 20:54:21 -05:00

check-fmt.yml

Update dependency astral-sh/uv to v0.10.7 (#18235)

2026-03-01 20:54:21 -05:00

check-generated-files.yml

Update actions/checkout action to v6.0.2 (#17683)

2026-01-26 10:53:48 +00:00

check-lint.yml

Update crate-ci/typos action to v1.43.5 (#18234)

2026-03-01 20:59:27 -05:00

check-publish.yml

Bump depot ubuntu runners to 24.04 (#17995)

2026-02-13 08:11:58 -05:00

check-release.yml

installers: Download uv releases from a mirror (#18191)

2026-02-27 11:58:00 -05:00

check-zizmor.yml

Update zizmorcore/zizmor-action action to v0.5.0 (#17939)

2026-02-09 12:52:50 -05:00

ci.yml

Allow pushing Docker images in pull requests for testing (#18253)

2026-03-03 07:40:23 -06:00

publish-crates.yml

Update actions/checkout action to v6.0.2 (#17683)

2026-01-26 10:53:48 +00:00

publish-docs.yml

Update actions/setup-python action to v6.2.0 (#17926)

2026-02-13 13:13:41 +01:00

publish-mirror.yml

Upload extra release artifacts to mirror (#18219)

2026-02-27 20:16:31 +00:00

publish-pypi.yml

Update astral-sh/setup-uv action to v7.3.1 (#18233)

2026-03-01 20:54:15 -05:00

publish-versions.yml

Update astral-sh/setup-uv action to v7.3.1 (#18233)

2026-03-01 20:54:15 -05:00

release.yml

installers: Download uv releases from a mirror (#18191)

2026-02-27 11:58:00 -05:00

setup-dev-drive.ps1

Increase the size of the Windows dev drives from 20GB -> 25GB (#15734)

2025-09-08 13:21:38 +00:00

sync-python-releases.yml

Update astral-sh/setup-uv action to v7.3.1 (#18233)

2026-03-01 20:54:15 -05:00

test-ecosystem.yml

Update actions/setup-python action to v6.2.0 (#17926)

2026-02-13 13:13:41 +01:00

test-integration.yml

Update aws-actions/configure-aws-credentials action to v6 (#18048)

2026-02-25 15:16:26 +01:00

test-smoke.yml

Update actions/checkout action to v6.0.2 (#17683)

2026-01-26 10:53:48 +00:00

test-system.yml

Update conda-incubator/setup-miniconda action to v3.3.0 (#17929)

2026-02-23 21:36:40 -05:00

test-windows-trampolines.yml

Update astral-sh/setup-uv action to v7.3.1 (#18233)

2026-03-01 20:54:15 -05:00

test.yml

Vendor mold installation and add more retries (#18271)

2026-03-03 11:59:58 -06:00