# Security & Releases
---
## SBOM
```bash
# SPDX format
dagger call generate-sbom-spdx --source=.
# CycloneDX format
dagger call generate-sbom-cyclone-dx --source=.
```
## Vulnerability Scanning
```bash
# Scan for CRITICAL and HIGH
dagger call scan-ci --source=.
# Custom severity
dagger call scan --source=. --severity="CRITICAL,HIGH,MEDIUM" --format="table"
```
## Supply Chain
- **SLSA Provenance** (Level 2) — generated by BuildKit during CI
- **Sigstore** — container images are signed
- **SBOM attestations** — embedded in registry manifests
- **OpenSSF Scorecard** — continuous security assessment
## Releasing
```bash
# Bump version, commit, tag, push
make release VERSION=0.9.0
```
This triggers:
1. `release.yml` — generates changelog with git-cliff, creates GitHub Release
2. `publish.yml` — builds and pushes Docker images (Alpine + Wolfi variants)
