From 6a25148576072fa0eda9e7dfa59017a8df18aa36 Mon Sep 17 00:00:00 2001 From: aromko Date: Fri, 20 Dec 2024 15:28:15 +0100 Subject: [PATCH 1/2] DST-633: setup dependency track --- .github/workflows/dependency-track.yml | 42 ++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/dependency-track.yml diff --git a/.github/workflows/dependency-track.yml b/.github/workflows/dependency-track.yml new file mode 100644 index 0000000000..bd1da035f4 --- /dev/null +++ b/.github/workflows/dependency-track.yml @@ -0,0 +1,42 @@ +name: Generate and Upload SBOM to Dependency-Track + +on: + push: + branches: + - main + pull_request: + branches: + - main + +jobs: + generate-and-upload-sbom: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + - uses: pnpm/action-setup@v4.0.0 + + - name: Set up Node.js + uses: actions/setup-node@v3 + with: + node-version: '22' + + - name: Install cdxgen + run: | + pnpm install -g @cyclonedx/cdxgen + + - name: Generate & upload SBOM to Dependency-Track + env: + DEPENDENCY_TRACK_API_KEY: ${{ secrets.DEPENDENCY_TRACK_API_KEY }} + DEPENDENCY_TRACK_SERVER: ${{ secrets.DEPENDENCY_TRACK_SERVER }} + DEPENDENCY_TRACK_PROJECT_NAME: ${{ secrets.DEPENDENCY_TRACK_PROJECT_NAME }} + DEPENDENCY_TRACK_PARENT_PROJECT_ID: ${{ secrets.DEPENDENCY_TRACK_PARENT_PROJECT_ID }} + DEPENDENCY_TRACK_PROJECT_VERSION: ${{ secrets.DEPENDENCY_TRACK_PROJECT_VERSION }} + DEPENDENCY_TRACK_FILE: ${{ secrets.DEPENDENCY_TRACK_FILE }} + run: | + cdxgen -r -o $DEPENDENCY_TRACK_FILE \ + --server-url $DEPENDENCY_TRACK_SERVER \ + --api-key $DEPENDENCY_TRACK_API_KEY \ + --project-name $DEPENDENCY_TRACK_PROJECT_NAME \ + --project-version $DEPENDENCY_TRACK_PROJECT_VERSION \ + --parent-project-id $DEPENDENCY_TRACK_PARENT_PROJECT_ID From a11e57a20064fd4dd7064fe234808fcd0bd14fe0 Mon Sep 17 00:00:00 2001 From: aromko Date: Mon, 23 Dec 2024 08:44:05 +0100 Subject: [PATCH 2/2] DST-633: update bom only when merged back to main branch --- .github/workflows/dependency-track.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/dependency-track.yml b/.github/workflows/dependency-track.yml index bd1da035f4..ecb62e2ec6 100644 --- a/.github/workflows/dependency-track.yml +++ b/.github/workflows/dependency-track.yml @@ -4,9 +4,6 @@ on: push: branches: - main - pull_request: - branches: - - main jobs: generate-and-upload-sbom: