also looking at this
fix(ci): gate release publishing on SBOM scan
#314
5 files
+44
-9
| @@ -4,6 +4,11 @@ on: | ||
| 4 | 4 | push: |
| 5 | 5 | branches: [main] |
| 6 | 6 | workflow_call: |
| 7 | inputs: | |
| 8 | enforce_high: | |
| 9 | description: Fail the release scan when High findings remain | |
| 10 | type: boolean | |
| 11 | default: false | |
| 7 | 12 | workflow_dispatch: |
| 8 | 13 | |
| 9 | 14 | concurrency: |
| @@ -26,7 +31,7 @@ jobs: | ||
| 26 | 31 | bun-version: latest |
| 27 | 32 | |
| 28 | 33 | - name: Install dependencies |
| 29 | run: bun install | |
| 34 | run: bun install --frozen-lockfile | |
| 30 | 35 | |
| 31 | 36 | - name: Install SBOM tools |
| 32 | 37 | run: | |
| @@ -121,6 +126,8 @@ jobs: | ||
| 121 | 126 | |
| 122 | 127 | - name: Scan and validate vulnerability report |
| 123 | 128 | run: bun scripts/scan-sbom.ts sbom/full-sbom.cyclonedx.json scan-results |
| 129 | env: | |
| 130 | CRAFT_FAIL_HIGH: ${{ inputs.enforce_high || false }} | |
| 124 | 131 | |
| 125 | 132 | - name: Upload scan results |
| 126 | 133 | if: ${{ always() }} |