From 61284540885f412a86149998401d45a202a056db Mon Sep 17 00:00:00 2001 From: nscuro Date: Thu, 8 Oct 2026 18:35:30 +0200 Subject: [PATCH] Refer to GitHub Action for WIF integration Signed-off-by: nscuro --- .../administration/configuring-workload-identity-federation.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/guides/administration/configuring-workload-identity-federation.md b/docs/guides/administration/configuring-workload-identity-federation.md index 699bd771..aff04e93 100644 --- a/docs/guides/administration/configuring-workload-identity-federation.md +++ b/docs/guides/administration/configuring-workload-identity-federation.md @@ -184,6 +184,9 @@ jobs: `ACTIONS_ID_TOKEN_REQUEST_URL` already carries a query string, which is why the audience is preceded by `&`. +To upload BOMs, the [`gh-upload-sbom`](https://github.com/DependencyTrack/gh-upload-sbom#workload-identity-federation) +action requests and exchanges the token for you. + ### GitLab CI GitLab CI issues ID tokens from the URL of the GitLab instance.