SBOM #14
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SBOM | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| sbom: | |
| runs-on: ubuntu-latest | |
| env: | |
| NPM_CONFIG_UNSAFE_PERM: true | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - run: npm install -g npm@latest | |
| - name: Bootstrap | |
| run: npm ci | |
| - name: Generate SBOM for the whole repository | |
| run: | | |
| npm sbom --sbom-format=spdx --legacy-peer-deps > sbom.spdx | |
| - name: Generate SBOMs for packages | |
| run: | | |
| for dir in $(find packages -mindepth 1 -maxdepth 1 -type d) | |
| do | |
| dir_name=$(basename "$dir") | |
| echo "Generating SBOM for $dir_name" | |
| npm sbom --sbom-format=spdx --legacy-peer-deps --workspace ${dir} > "${dir_name}.spdx" | |
| done | |
| - name: Generate SBOMs for experimental packages | |
| run: | | |
| for dir in $(find experimental/packages -mindepth 1 -maxdepth 1 -type d) | |
| do | |
| dir_name=$(basename "$dir") | |
| echo "Generating SBOM for $dir_name" | |
| npm sbom --sbom-format=spdx --legacy-peer-deps --workspace ${dir} > "${dir_name}.spdx" | |
| done | |
| - name: Zip all SBOM files | |
| run: | | |
| zip sbom.zip *.spdx | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| path: ./sbom.zip | |
| name: "SBOM" |