ledgerbase/.github/workflows/sbom.yml at e789d6e6e7c6a196299ced5125b74d2e339d9f17 · williaby/ledgerbase · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
---
# Front-Matter for GitHub Workflow

title: "Security – SBOM"
name: "sbom.yml"
description: "Generates and validates Software Bill of Materials (SBOM) for the project"
category: security
usage: "Triggered on push, pull request, or manual workflow dispatch"
behavior: "Generates SBOM in CycloneDX format and validates it"
inputs: "Project source code and dependencies"
outputs: "CycloneDX SBOM artifact (docs/generated/sbom/sbom.cdx.json)"
dependencies: "Poetry, Nox, Trivy, Docker Buildx"
author: "Byron Williams"
last_modified: "2023-11-15"
changelog: "Updated header to match annotation specification"
tags: [security, sbom, workflow]
---

name: Security – SBOM

on:
  push:
  pull_request:
  workflow_dispatch: {}

permissions:
  contents: read
  security-events: write

jobs:
  # 1. Prepare Poetry & Assured OSS environment (with caching)
  prepare:
    uses: ./.github/workflows/templates/prepare-poetry.yml
    with:
      GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}
    secrets:
      GCP_SA_JSON: ${{ secrets.GCP_SA_JSON }}

  sbom:
    name: Generate & Validate SBOM
    needs: prepare
    runs-on: ubuntu-22.04

    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1

      - name: Verify no public PyPI fallbacks
        run: poetry run nox -s verify_assured

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55  # v2.10.0

      - name: Install Trivy & wget
        run: |
          sudo apt-get update && sudo apt-get install -y wget
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
            | sh -s -- -b /usr/local/bin

      - name: Run SBOM Validate via Poetry
        run: poetry run nox -s sbom_validate

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
        with:
          name: sbom-cyclonedx
          path: docs/generated/sbom/sbom.cdx.json
          retention-days: 7