-
Notifications
You must be signed in to change notification settings - Fork 1
40 lines (32 loc) · 987 Bytes
/
sbom.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
---
name: SBOM Generator
on:
push:
branches:
- 'master'
workflow_dispatch:
permissions: read-all
jobs:
generate-and-push-sbom:
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Install cdxgen
run: |
npm install -g @cyclonedx/cdxgen
- name: 'Generate SBOM for ruby dependencies'
run: |
cdxgen -o ./sbom-ruby.xml -t ruby .
- name: 'Push SBOM to dependency track'
env:
PROJECT_NAME: decidim-zuerich
run: |
curl --verbose -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
--header "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
--header "Content-Type: multipart/form-data" \
--form "autoCreate=true" \
--form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
--form "projectVersion=latest" \
--form "[email protected]"
...