- Add Trivy vulnerability scanning (fails on CRITICAL/HIGH) - Add Syft SBOM generation in SPDX format - Add Cosign image signing using digest - Attach SBOM attestation to image in Harbor - Add cosign.pub for signature verification
- Add Trivy vulnerability scanning (fails on CRITICAL/HIGH) - Add Syft SBOM generation in SPDX format - Add Cosign image signing using digest - Attach SBOM attestation to image in Harbor - Add cosign.pub for signature verification