docs: initialize blueprint development structure #147
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SBOM Generation | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| release: | |
| types: [published] | |
| workflow_dispatch: # Allow manual triggering | |
| permissions: | |
| contents: write # Required for uploading SBOM artifacts | |
| jobs: | |
| sbom: | |
| name: Generate SBOM | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Homebrew | |
| uses: Homebrew/actions/setup-homebrew@master | |
| - name: Install chezmoi | |
| run: brew install chezmoi | |
| - name: Generate SBOM with Syft | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| format: spdx-json | |
| output-file: sbom-spdx.json | |
| upload-artifact: true | |
| upload-release-assets: ${{ github.event_name == 'release' }} | |
| - name: Generate CycloneDX SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| format: cyclonedx-json | |
| output-file: sbom-cyclonedx.json | |
| upload-artifact: true | |
| - name: Scan SBOM for vulnerabilities with Grype | |
| uses: anchore/scan-action@v4 | |
| with: | |
| sbom: sbom-spdx.json | |
| fail-build: false # Set to true to fail on vulnerabilities | |
| severity-cutoff: high | |
| - name: Upload vulnerability report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: vulnerability-report | |
| path: | | |
| *.sarif | |
| sbom-*.json | |
| retention-days: 90 | |
| - name: Create SBOM summary | |
| if: always() | |
| run: | | |
| { | |
| echo "## 📦 Software Bill of Materials (SBOM)" | |
| echo "" | |
| echo "SBOM files have been generated for this build:" | |
| echo "- \`sbom-spdx.json\` (SPDX format)" | |
| echo "- \`sbom-cyclonedx.json\` (CycloneDX format)" | |
| echo "" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| if [ -f "sbom-spdx.json" ]; then | |
| { | |
| echo "### Dependencies Summary" | |
| echo "\`\`\`" | |
| jq -r '.packages | length' sbom-spdx.json | xargs -I {} echo "Total packages: {}" | |
| echo "\`\`\`" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| fi |