CRI-Python-Lib/.github/workflows/sbom.yml at master · CommonplaceRobotics/CRI-Python-Lib · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: Generate SBOM

on:
  push:
    branches: [ "master", "ci" ]
  pull_request:
    branches: [ "master" ]

permissions:
  contents: read

jobs:
  sbom:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v6

    # Liest die Core-Version aus CMakeLists.txt
    - name: Get software version
      run: |
        VER=`grep -E -o "version[[:blank:]]+=[[:blank:]]\"+[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+" pyproject.toml | sed "s/[^0-9.]*//g"`
        echo "Software version '$VER' detected"
        echo "SW_VERSION=$VER" >> $GITHUB_ENV

    # Create a package of the source code so that we can hash it for the SBOM
    - name: Create package
      run: |
        mkdir package
        zip package/cri_lib.zip cri_lib/*

    - name: Export package
      uses: actions/upload-artifact@v7
      with:
        name: sources
        path: package/cri_lib.zip

    - name: Create SBOM
      uses: sbomify/sbomify-action@master
      env:
        LOCK_FILE: requirements.txt
        OUTPUT_FILE: sbom_temp.cdx.json
        COMPONENT_NAME: CRI-Python-Lib
        COMPONENT_VERSION: ${{ env.SW_VERSION }}
        # Produkt- und Firmeninfo werden aus sbomify.json geladen
        AUGMENT: true
        # Metadaten aus Paket-Registry hinzufügen
        ENRICH: true
        UPLOAD: false

    - name: Final SBOM enrichment
      uses: CommonplaceRobotics/Action_SBOM_Enrichment@v7
      with:
        database: .github/workflows/sbom_enrichment_db.json
        sbom: sbom_temp.cdx.json
        sbom_out: sbom.cdx.json

    - name: Export SBOM
      uses: actions/upload-artifact@v7
      with:
        path: sbom.cdx.json
        archive: false

    - name: Validate SBOM with company policies
      uses: CommonplaceRobotics/Action_Validate_SBOM@v5
      with:
        sbom: sbom.cdx.json