new sbom step testing

2026-09-29 11:07:42 +10:00
parent 1713fb498c
commit 252bd874aa
4 changed files with 7100 additions and 1 deletions
@@ -0,0 +1,36 @@
+name: Dependency Tracking
+
+on:
+  push:
+    branches:
+      - feat/dep-setup
+
+jobs:
+  sbom:
+    name: SBOM Generation and Upload
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    - name: Setup PNPM and Node
+      uses: pnpm/setup@v3
+      with:
+        runtime: node@20
+
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+
+    - name: Generate SBOM
+      run: pnpm sbom --sbom-format cyclonedx --out sbom.cyclonedx.json
+
+    - name: Upload SBOM
+      uses: DependencyTrack/gh-upload-sbom@v4
+      with:
+        protocol: ${{ vars.DT_API_PROTOCOL }}
+        server-hostname: ${{ vars.DT_API_HOSTNAME }}
+        port: ${{ vars.DT_API_PORT }}
+        api-key: ${{ secrets.DT_API_KEY }}
+        project-name: 'Code Snippets'
+        project-version: 'main'
+        bom-file: 'sbom.cyclonedx.json'