Alex Goodman

thats because I'm cheating: https://github.com/wagoodman/bashful/blob/master/main.go#L147 A 'bundle' in this case is just a shell script with a tar concatenated with it. The tar has bashful and other used files. The...

I see nothing that you're doing wrong, and I can't seem to reproduce this yet: ``` $ bashful run hello.yaml Running • echo "Hello, World!" 100.00% Complete Tasks[1/1] $ ```...

try upgrading go to at least v1.11 (or higher), which is when go modules were introduced (and being used here to pin the version of dependencies)

@karuppiah7890 it's a good start. I think I would probably make it even slimmer by not even using `go get` to grab/compile it. Instead a plain `wget https://github.com/wagoodman/bashful/releases/download/v0.1.1/bashful_0.1.1_linux` and throwing...

Currently WIP with https://github.com/wagoodman/bashful/tree/refactor-with-lib ...

> I didn't see many comments about tracing points, other than only tracing the build result is not enough in many cases. We could include build context. ... Does something...

What we should do is at least add more documentation as to what the philosophies we follow when crafting SBOMs. I would say that keeping SBOMs easily reproducible is a...

Not all output formats are guarenteed to be reproducible. For instance, CycloneDX can never be reproducible given that IDs are recommended to be random. That being said, there is a...

It's an interesting idea, and based on the search features that exist today I think this would be a relatively small lift to add. (side note, it could even be...

I see there is a closed PR with this issue. It seems like one of the leading reasons for closing is that it duplicates logic about releasing to multiple places....