Skip to content

Commit 74b341c

Browse files
ekovaletsekovalets
committed
NODE-7025: New SBOM generation workflow on dependencies change
1 parent 49c5b6f commit 74b341c

File tree

4 files changed

+178
-0
lines changed

4 files changed

+178
-0
lines changed

‎.github/actions/sbom-update/action.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Generate SBOM
2+
description: Generates CycloneDX SBOM using cdxgen
3+
inputs:
4+
output-file:
5+
description: "Output filename for the SBOM"
6+
required: false
7+
default: "sbom.json"
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- name: Generate SBOM
13+
shell: bash
14+
working-directory: ${{ inputs.working-directory }}
15+
run: |
16+
echo "Generating SBOM for 'node' project..."
17+
cdxgen -t 'node' --spec-version 1.5 --json-pretty -o ${{ inputs.output-file }} .
18+
19+
- name: Validate SBOM
20+
shell: bash
21+
run: |
22+
if [ ! -f "${{ inputs.output-file }}" ]; then
23+
echo "Error: SBOM file not found"
24+
exit 1
25+
fi
26+
27+
echo "SBOM file validated: ${{ inputs.output-file }}"

‎.github/actions/setup-sbom/action.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Setup PHP SBOM
2+
description: Sets up environment for generating SBOM in PHP projects
3+
inputs:
4+
working-directory:
5+
description: "The directory where composer.json is located"
6+
required: false
7+
default: "."
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- name: Setup Node.js (for cdxgen)
13+
uses: actions/setup-node@v4
14+
with:
15+
node-version: '20'
16+
17+
- name: Install cdxgen
18+
shell: bash
19+
run: npm install -g @cyclonedx/cdxgen

‎.github/actions/setup/action.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Setup Node SBOM
2+
description: Sets up environment for generating SBOM in Node.js projects
3+
inputs:
4+
working-directory:
5+
description: "The directory where package.json is located"
6+
required: false
7+
default: "."
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- name: Setup Node.js (for cdxgen)
13+
uses: actions/setup-node@v4
14+
with:
15+
node-version: '20'
16+
17+
- name: Install cdxgen
18+
shell: bash
19+
run: npm install -g @cyclonedx/cdxgen

‎.github/workflows/sbom.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: Post-Merge SBOM Update
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'package.json'
9+
- 'package-lock.json'
10+
workflow_dispatch:
11+
env:
12+
SBOM_FILE: "sbom.json"
13+
permissions:
14+
contents: write
15+
pull-requests: write
16+
17+
jobs:
18+
sbom:
19+
name: Generate SBOM and Create PR
20+
runs-on: ubuntu-latest
21+
22+
concurrency:
23+
group: sbom-${{ github.ref }}
24+
cancel-in-progress: false
25+
26+
steps:
27+
- name: Checkout repository (Base Branch)
28+
uses: actions/checkout@v5
29+
with:
30+
ref: ${{ github.event.pull_request.base.ref || github.ref }}
31+
token: ${{ secrets.GITHUB_TOKEN }}
32+
33+
- name: Install Node and dependencies
34+
uses: mongodb-labs/drivers-github-tools/node/setup@v3
35+
with:
36+
ignore_install_scripts: false
37+
38+
- name: Load version and package info
39+
uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
40+
with:
41+
npm_package_name: mongodb
42+
43+
- name: Generate/Update package-lock.json
44+
run: |
45+
echo "Resolving dependencies and generating package-lock.json..."
46+
npm install --package-lock-only
47+
echo "package-lock.json generated with resolved versions"
48+
49+
- name: Setup SBOM environment
50+
uses: ./.github/actions/setup-sbom
51+
52+
- name: Generate SBOM
53+
uses: ./.github/actions/sbom-update
54+
with:
55+
output-file: ${SBOM_FILE}
56+
57+
- name: Check for Changes in sbom.json
58+
id: git_status
59+
run: |
60+
# Filter to remove/normalize serialNumber and timestamp fields
61+
JQ_NORMALIZER='del(.serialNumber) | del(.metadata.timestamp) | walk(if type == "object" and .timestamp then .timestamp = "TIMESTAMP_NORMALIZED" else . end)'
62+
63+
# Check if the base file exists in Git (to prevent errors on first commit)
64+
if ! git show HEAD:$SBOM_FILE > /dev/null 2>&1; then
65+
echo "HAS_CHANGES=true" >> $GITHUB_OUTPUT
66+
exit 0
67+
fi
68+
69+
# Compare the normalized committed version vs. the normalized current version
70+
if diff -q \
71+
<(git show HEAD:$SBOM_FILE | jq -r "$JQ_NORMALIZER") \
72+
<(cat $SBOM_FILE | jq -r "$JQ_NORMALIZER"); then
73+
74+
echo "HAS_CHANGES=false" >> $GITHUB_OUTPUT
75+
echo "No changes detected in sbom.json"
76+
else
77+
echo "HAS_CHANGES=true" >> $GITHUB_OUTPUT
78+
echo "Changes detected in sbom.json"
79+
fi
80+
81+
- name: Create Pull Request
82+
if: steps.git_status.outputs.HAS_CHANGES == 'true'
83+
uses: peter-evans/create-pull-request@v6
84+
with:
85+
token: ${{ secrets.GITHUB_TOKEN }}
86+
commit-message: 'chore: update SBOM after dependency changes'
87+
branch: auto-update-sbom-${{ github.run_id }}
88+
delete-branch: true
89+
title: 'chore: Update SBOM'
90+
body: |
91+
## Automated SBOM Update
92+
93+
This PR was automatically generated because package files changed.
94+
95+
### Environment
96+
- Node.js version: ${{ steps.versions.outputs.node-version }}
97+
98+
### Changes
99+
- Updated `sbom.json` to reflect current dependencies
100+
101+
### Verification
102+
The SBOM was generated using CycloneDX NPM.
103+
104+
### Triggered by
105+
- Commit: ${{ github.sha }}
106+
- Workflow run: ${{ github.run_id }}
107+
108+
---
109+
_This PR was created automatically by the [SBOM workflow](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})_
110+
labels: |
111+
sbom
112+
automated
113+
dependencies

0 commit comments

Comments
 (0)