reusable-sbom.yaml

name: Generate and push an SBOM dependency list

on:
  workflow_call:
    inputs:
      project_name:
        type: string
        description: "Project name to report to dependency track"
        required: true
      artifact-prefix:
        type: string
        description: "what to prefix the artifacts with e.g. int-"
        default: ""
      
    secrets:
      dependency_track_url:
        description: "Base URL of the dependency track instance"
        required: true
      dependency_track_api_key:
        description: "API key to use for sending data to dependency track"
        required: true

jobs:
  generate-and-push-sbom:
    runs-on: 'ubuntu-latest'
    # env:
    #   HEADLESS: true
    #   RAILS_TEST_DB_NAME: 'postgres'
    #   RAILS_TEST_DB_USERNAME: 'postgres'
    #   RAILS_TEST_DB_PASSWORD: 'postgres'
    #   RAILS_ENV: 'test'
    #   CI: 'true'
    #   PGDATESTYLE: German
    #
    # services:
    #   postgres:
    #     image: 'postgres:11'
    #     env:
    #       POSTGRES_PASSWORD: 'postgres'
    #     ports: [ '5432:5432' ]
    #     options: >-
    #       --health-cmd pg_isready
    #       --health-interval 10s
    #       --health-timeout 10s
    #       --health-retries 10
    #   memcached:
    #     image: 'memcached'
    #     ports: [ '11211:11211' ]

    steps:
      - uses: actions/checkout@v4
      - name: 'Generate SBOM for ruby and npm dependencies'
        run: |
          npm install -g @cyclonedx/cdxgen
          cdxgen -o ./sbom-ruby.json -t ruby .
          cdxgen -o ./sbom-npm.json -t npm .

      - name: 'Merge frontend and backend SBOMs'
        run: |
          docker run \
                 --rm \
                 -v $(pwd):/data \
                 cyclonedx/cyclonedx-cli \
                 merge \
                 --input-files data/sbom-ruby.json data/sbom-npm.json \
                 --output-file data/sbom.xml
      
      - name: 'Push merged SBOM to dependency track'
        run: |
          curl --verbose \
               -s \
               --location \
               --request POST ${{ secrets.dependency_track_url }}/api/v1/bom \
               --header "X-Api-Key: ${{ secrets.dependency_track_api_key }}" \
               --header "Content-Type: multipart/form-data" \
               --form "autoCreate=true" \
               --form "projectName=${{ inputs.project_name }}" \
               --form "projectVersion=latest" \
               --form "bom=@sbom.xml"
      
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: ${{ inputs.artifact-prefix }}sboms
          path: |
            ./sbom-npm.json
            ./sbom-ruby.json
            ./sbom.xml