sbom.yml

# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: SBOM

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  build_sbom:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.11']
    steps:
    - uses: actions/checkout@v2
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v2
      with:
        python-version: ${{ matrix.python-version }}
    - name: Prepare requirements file
      run: |
        python -m pip install --upgrade pip
        python -m pip install .
        pip freeze > requirements_frozen.txt
    - name: SBOM with CycloneDX
      run: |
        python -m pip install cyclonedx-bom
        cyclonedx-py requirements requirements_frozen.txt -o sbom.xml
    - name: Upload Build Artifacts
      uses: actions/upload-artifact@v2
      with:
        name: sbom.xml
        path: sbom.xml