sbom.yaml

# SPDX-FileCopyrightText: 2024 DB Systel GmbH
#
# SPDX-License-Identifier: Apache-2.0

name: Full SBOM Workflow

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  # sbom-gen:
  #   runs-on: ubuntu-22.04
  #   steps:
  #     - uses: actions/checkout@v4
  #     - name: Install cdxgen
  #       run: npm install -g @cyclonedx/cdxgen
  #     - name: Generate CycloneDX SBOM with cdxgen
  #       run: cdxgen -r . -o ${{ runner.temp }}/sbom-raw.json
  #     - name: Store raw SBOM as artifact
  #       uses: actions/upload-artifact@v4
  #       with:
  #         name: sbom-raw
  #         path: ${{ runner.temp }}/sbom-raw.json
  sbom-gen:
    runs-on: ubuntu-22.04
    container:
      image: ghcr.io/cyclonedx/cdxgen
      volumes:
        - ${{ github.workspace }}:/app
        - ${{ runner.temp }}:/sbom_data
      options: --cpus 1
    steps:
      - name: Generate SBOM
        run: -r /app -o /sbom_data/sbom-raw.json
      - name: Store raw SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom-raw
          path: ${{ runner.temp }}/sbom-raw.json


  sbom-enrich:
    runs-on: ubuntu-22.04
    needs: sbom-gen
    steps:
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install compliance-assistant
        run: pip install compliance-assistant
      - uses: actions/download-artifact@v4
        with:
          name: sbom-raw
          path: ${{ runner.temp }}
      - name: Enrich SBOM
        run: compliance-assistant sbom-enrich -f ${{ runner.temp }}/sbom-raw.json -o ${{ runner.temp }}/sbom-enriched.json
      - name: Store enriched SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom-enriched
          path: ${{ runner.temp }}/sbom-enriched.json