ReviewOS
Reload

also looking at this

craft-native/craft

fix(sbom): preserve the full dependency inventory when merging

#297
Merged glennmichael123 wants to merge codex/sbom-inventory into main
4 files +106 -120
.github/workflows/sbom.ymlmodified+2-120
@@ -43,126 +43,8 @@ jobs:
4343 syft . -o cyclonedx-json=sbom/full-sbom.cyclonedx.json
4444 syft . -o spdx-json=sbom/full-sbom.spdx.json
4545
46 - name: Generate Zig dependencies SBOM
47 run: |
48 # Create a custom SBOM for Zig dependencies
49 cat > sbom/zig-dependencies.json << 'EOF'
50 {
51 "bomFormat": "CycloneDX",
52 "specVersion": "1.5",
53 "version": 1,
54 "metadata": {
55 "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
56 "component": {
57 "type": "library",
58 "name": "craft-zig-core",
59 "version": "0.0.1",
60 "description": "Craft Zig Core - Native application framework"
61 }
62 },
63 "components": [
64 {
65 "type": "library",
66 "name": "zig-std",
67 "version": "stable",
68 "description": "Zig Standard Library",
69 "purl": "pkg:zig/std@stable",
70 "licenses": [{"license": {"id": "MIT"}}]
71 }
72 ],
73 "externalReferences": [
74 {
75 "type": "website",
76 "url": "https://github.com/craft-native/craft"
77 },
78 {
79 "type": "vcs",
80 "url": "https://github.com/craft-native/craft.git"
81 }
82 ]
83 }
84 EOF
85
86 # Add platform-specific dependencies
87 cat > sbom/platform-dependencies.json << 'EOF'
88 {
89 "bomFormat": "CycloneDX",
90 "specVersion": "1.5",
91 "version": 1,
92 "metadata": {
93 "component": {
94 "type": "application",
95 "name": "craft-platform-deps",
96 "version": "0.0.1"
97 }
98 },
99 "components": [
100 {
101 "type": "library",
102 "name": "WebKit",
103 "description": "macOS WebKit framework",
104 "purl": "pkg:apple/webkit",
105 "licenses": [{"license": {"id": "LGPL-2.1-or-later"}}],
106 "properties": [{"name": "platform", "value": "macos"}]
107 },
108 {
109 "type": "library",
110 "name": "GTK3",
111 "description": "GTK 3 toolkit",
112 "purl": "pkg:generic/gtk@3",
113 "licenses": [{"license": {"id": "LGPL-2.1-or-later"}}],
114 "properties": [{"name": "platform", "value": "linux"}]
115 },
116 {
117 "type": "library",
118 "name": "WebKit2GTK",
119 "version": "4.1",
120 "description": "WebKit2 GTK port",
121 "purl": "pkg:generic/webkit2gtk@4.1",
122 "licenses": [{"license": {"id": "LGPL-2.1-or-later"}}],
123 "properties": [{"name": "platform", "value": "linux"}]
124 },
125 {
126 "type": "library",
127 "name": "WebView2",
128 "description": "Microsoft Edge WebView2",
129 "purl": "pkg:nuget/Microsoft.Web.WebView2",
130 "licenses": [{"license": {"id": "BSD-3-Clause"}}],
131 "properties": [{"name": "platform", "value": "windows"}]
132 }
133 ]
134 }
135 EOF
136
137 - name: Merge SBOMs
138 run: |
139 # Create a merged SBOM with all components
140 cat > sbom/craft-sbom.json << EOF
141 {
142 "bomFormat": "CycloneDX",
143 "specVersion": "1.5",
144 "version": 1,
145 "serialNumber": "urn:uuid:$(uuidgen || cat /proc/sys/kernel/random/uuid)",
146 "metadata": {
147 "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
148 "tools": [
149 {"name": "syft"}
150 ],
151 "component": {
152 "type": "application",
153 "name": "craft",
154 "version": "${GITHUB_REF_NAME:-0.0.1}",
155 "description": "Build desktop apps with web languages, powered by Zig",
156 "licenses": [{"license": {"id": "MIT"}}],
157 "externalReferences": [
158 {"type": "website", "url": "https://github.com/craft-native/craft"},
159 {"type": "vcs", "url": "https://github.com/craft-native/craft.git"},
160 {"type": "issue-tracker", "url": "https://github.com/craft-native/craft/issues"}
161 ]
162 }
163 }
164 }
165 EOF
46 - name: Merge scanned and declared runtime dependencies
47 run: bun scripts/merge-sbom.ts sbom
16648
16749 - name: Validate SBOMs
16850 run: |