Sbom dependency demo

上次分享後有些夥伴私訊問了SBOM 在 Github 示範的內容, 把它分享如下:

Github -> Insights -> Dependency graph

也可以把 spdx 格式的內容匯出到自己的系統匯入.

Github Action 內容:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
name: MSFT SBOM Creation

on: 
  workflow_dispatch:

jobs:
  SBOM-upload:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - name: Generate SBOM
      run: | 
        curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
        chmod +x $RUNNER_TEMP/sbom-tool
        $RUNNER_TEMP/sbom-tool generate -b . -bc . -pn ${{ github.repository }} -pv 1.0.0 -ps OwnerName -nsb https://sbom.mycompany.com -V Verbose
    - uses: actions/upload-artifact@v3
      with:
        name: sbom
        path: _manifest/spdx_2.2

HTH. 2023-04-26 By Jacky