Create SBOM #1292
Merged
Create SBOM #1292
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Also move runtime deps to dependencies to try to create a better sbom
Docker image is tagged in node-build action
jaredgalanis
approved these changes
Dec 5, 2024
There was a problem hiding this comment.
Looks good to me. I think there are some packages we could talk about moving, but I think in the interest of getting this started it's okay to include them as is for now.
For reference, here's what an app's package.json would look like if you did ember new, which might be instructive for us. https://github.com/ember-cli/ember-new-output/blob/v5.12.0/package.json
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR has the following changes:
create_sbomin package.json scripts.dependenciesin package.json and moved "runtime" dependencies to this section. Please review these to ensure I have not missed any from devDependencies or have a dependency that is not a runtime dependency.eclipse-pass/main/.github/actions/node-build@mainaction instead of thebuild-pass-uiaction.build-pass-uihas been removed.latesttag from docker images created by github action workflows. This is to be more consistent with other repo action snapshot/release workflows.The way I have things configured now, an SBOM will be created and copied into the corresponding Docker image whenever a PR is merged and when PASS is released.
Note this PR should be merged after the main PR is merged: eclipse-pass/main#1087