SW_PositionInterfaceClient/.github/workflows/sbom.yml at master · CommonplaceRobotics/SW_PositionInterfaceClient · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: SBOM and Security Audit

on:
  push:
    branches: [ "master" ]
  pull_request:
    branches: [ "master" ]
  # Workflow can be triggered manually
  workflow_dispatch:

jobs:

  # Erstellt die SBOM und führt einen Schwachstellenscan durch
  sbom:
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
    - uses: actions/checkout@v6

    # Liest die Core-Version aus dem NSIS-Installer-Skript
    - name: Get software version
      run: |
        VER_MAJOR=`grep -E -o "SWVersionMajor[[:blank:]]+=[[:blank:]][[:digit:]]+" MainWindow.xaml.cs | sed "s/[^0-9.]*//g"`
        VER_MINOR=`grep -E -o "SWVersionMinor[[:blank:]]+=[[:blank:]][[:digit:]]+" MainWindow.xaml.cs | sed "s/[^0-9.]*//g"`
        VER_PATCH=`grep -E -o "SWVersionPatch[[:blank:]]+=[[:blank:]][[:digit:]]+" MainWindow.xaml.cs | sed "s/[^0-9.]*//g"`
        echo "Software version '$VER_MAJOR.$VER_MINOR.$VER_PATCH' detected"
        echo "SW_VERSION=$VER_MAJOR.$VER_MINOR.$VER_PATCH" >> $GITHUB_ENV

    # SBOM erstellen
    # Wie man die packages.lock.json bekommt: https://devblogs.microsoft.com/dotnet/enable-repeatable-package-restores-using-a-lock-file/
    - uses: sbomify/sbomify-action@master
      env:
        LOCK_FILE: ${{ github.workspace }}/packages.lock.json
        OUTPUT_FILE: sbom.cdx.json
        COMPONENT_NAME: Position Interface Client
        COMPONENT_VERSION: ${{ env.SW_VERSION }}
        # Produkt- und Firmeninfo werden aus sbomify.json geladen
        AUGMENT: true
        # Metadaten aus Paket-Registry hinzufügen
        ENRICH: true
        # Metadaten aus additional_packages.txt hinzufügen
        #ADDITIONAL_PACKAGES_FILE: ${{ github.workspace }}/additional_packages.txt
        UPLOAD: false

    - name: Export SBOM
      uses: actions/upload-artifact@v7
      with:
        path: sbom.cdx.json
        archive: false

    - uses: actions/setup-go@v6

    - name: Install SBOM QA tool
      run: go install github.com/interlynk-io/sbomqs@latest

    - name: SBOM quality score
      run: sbomqs score sbom.cdx.json

    # Checks compliance with the latest version of BSI TR-03183-2
    - name: Check CRA compliance
      run: sbomqs compliance --bsi --color sbom.cdx.json

    - name: List component licenses
      run: sbomqs list --feature comp_with_declared_license --show sbom.cdx.json

    # TODO: Nicht CRA-konforme Felder füllen

    # Security Audit
    - name: Scan for vulnerabilities
      uses: anchore/scan-action@v7
      with:
        sbom: sbom.cdx.json
        cache-db: true