Skip to content

New Person (#653)

New Person (#653) #106

Workflow file for this run

name: SBOM
on:
push:
branches:
- 'master'
workflow_dispatch:
jobs:
generate-and-push-sbom:
runs-on: ubuntu-latest
steps:
- name: 'Checkout'
uses: actions/checkout@v4
- name: 'Generate SBOM for Ruby dependencies'
uses: docker://ghcr.io/cyclonedx/cdxgen:v10.0.4
with:
args: --spec-version 1.4 -p -o bom-ruby.json -t ruby .
- name: 'Generate SBOM for Node.js dependencies'
uses: docker://ghcr.io/cyclonedx/cdxgen:v10.0.4
with:
args: --spec-version 1.4 -p -o bom-npm.json -t js .
- name: 'Merge Ruby and Node.js SBOMs'
uses: docker://cyclonedx/cyclonedx-cli:0.25.0
with:
args: merge --input-format json --input-files bom-ruby.json bom-npm.json --output-format json --output-file bom.json
- name: 'Push merged SBOM to dependency track'
env:
PROJECT_NAME: skills
run: |
curl -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
--header "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
--header "Content-Type: multipart/form-data" \
--form "autoCreate=true" \
--form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
--form "projectVersion=latest" \
--form "[email protected]"