mirror of
https://github.com/LearningCircuit/local-deep-research.git
synced 2026-06-15 19:46:56 +03:00
56290b15c0
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.19.0 to 2.19.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](8d3c67de8e...a5ad31d6a1)
---
updated-dependencies:
- dependency-name: step-security/harden-runner
dependency-version: 2.19.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
82 lines
2.7 KiB
YAML
82 lines
2.7 KiB
YAML
name: SBOM Generation
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
# Run weekly on Wednesday at 10 AM UTC (staggered with other scans)
|
|
- cron: '0 10 * * 3'
|
|
release:
|
|
types: [published]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
sbom:
|
|
name: Generate Software Bill of Materials
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Generate SBOM for source code
|
|
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
|
|
with:
|
|
path: .
|
|
artifact-name: sbom-source.spdx.json
|
|
output-file: sbom-source.spdx.json
|
|
format: spdx-json
|
|
|
|
- name: Generate SBOM for Python dependencies
|
|
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
|
|
with:
|
|
path: .
|
|
artifact-name: sbom-python.cyclonedx.json
|
|
output-file: sbom-python.cyclonedx.json
|
|
format: cyclonedx-json
|
|
|
|
- name: Upload SBOMs as artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: sbom-reports
|
|
path: |
|
|
sbom-source.spdx.json
|
|
sbom-python.cyclonedx.json
|
|
retention-days: 90
|
|
|
|
- name: Display SBOM summary
|
|
run: |
|
|
{
|
|
echo "## SBOM Generation Summary"
|
|
echo ""
|
|
echo "### Generated SBOMs"
|
|
echo "- **Source Code SBOM**: \`sbom-source.spdx.json\` (SPDX format)"
|
|
echo "- **Dependencies SBOM**: \`sbom-python.cyclonedx.json\` (CycloneDX format)"
|
|
echo ""
|
|
echo "### What is an SBOM?"
|
|
echo "A Software Bill of Materials (SBOM) is a formal record of all components,"
|
|
echo "libraries, and dependencies used in building software. It enables:"
|
|
echo ""
|
|
echo "- **Vulnerability tracking**: Know exactly what's in your software"
|
|
echo "- **License compliance**: Verify all dependencies have compatible licenses"
|
|
echo "- **Supply chain security**: Detect compromised dependencies"
|
|
echo "- **Regulatory compliance**: Meet requirements (EO 14028, etc.)"
|
|
echo ""
|
|
echo "### Artifacts"
|
|
echo "SBOMs are available as workflow artifacts for 90 days."
|
|
if [ "${{ github.event_name }}" = "release" ]; then
|
|
echo ""
|
|
echo "SBOMs have also been attached to the release assets."
|
|
fi
|
|
} >> "$GITHUB_STEP_SUMMARY"
|