Skip to content

Save / Publish SBOMs to GitHub Packages #33757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mpreyskurantov wants to merge 24 commits into from
Closed

Save / Publish SBOMs to GitHub Packages #33757

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
ebb1509
cyclonedx cli validate sbom
mpreyskurantov May 25, 2026
5411141
sha256sum / checksum
mpreyskurantov Jun 3, 2026
e2aab28
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jun 4, 2026
16d2046
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jun 5, 2026
73369e3
CYCLONEDX_CLI: WIN -> LINUX (after #33854)
mpreyskurantov Jun 5, 2026
76ef292
CYCLONEDX_CLI: WIN -> LINUX, v2, exe || true (after #33854)
mpreyskurantov Jun 5, 2026
aaffe18
SBOM package(s) flow (like for NPM package(s))
mpreyskurantov Jun 5, 2026
0da90d6
SBOM package(s) optimized flow only (no NPM package(s))
mpreyskurantov Jun 5, 2026
7614d05
revert "continue-on-error: true"
mpreyskurantov Jun 8, 2026
935e8e2
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jun 8, 2026
6cf243a
Revert "SBOM package(s) optimized flow only (no NPM package(s))"
mpreyskurantov Jun 8, 2026
eb2326f
*.sbom.json -> *.cdx.json
mpreyskurantov Jun 8, 2026
525e50b
dx-make-sbom with hashes
mpreyskurantov Jun 8, 2026
3ed1bf0
hasSbom for tgz
mpreyskurantov Jun 8, 2026
5519d6c
build-hashed
mpreyskurantov Jun 9, 2026
b223804
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jun 10, 2026
f036feb
validate via action
mpreyskurantov Jun 10, 2026
d8cb985
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jun 16, 2026
c29251a
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jun 17, 2026
8f9a65f
DevExpress/github-actions/validate-sbom + commit hash
mpreyskurantov Jun 17, 2026
6bb3327
publish scoped sboms instantly (without changing scope)
mpreyskurantov Jun 20, 2026
2212238
packages/sbom/pnpm-lock.yaml: the lockfile contains entries that the …
mpreyskurantov Jun 21, 2026
0486532
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jul 3, 2026
2329597
Merge remote-tracking branch 'origin(upstream)/26_1' into 26_1-sbom-v…
mpreyskurantov Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion .github/workflows/build_all.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ on:
env:
NX_CLOUD_ACCESS_TOKEN: ${{ github.ref_name == github.event.repository.default_branch && secrets.NX_CLOUD_ACCESS_TOKEN || '' }}
NX_SKIP_NX_CACHE: ${{ contains(github.event.pull_request.labels.*.name, 'skip-cache') && 'true' || 'false' }}
CYCLONEDX_CLI_VERSION: 0.32.0
CYCLONEDX_CLI_LINUX_X64_SHA256: 454879e6a4a405c8a13bff49b8982adcb0596f3019b26b0811c66e4d7f0783e1

jobs:
build:
Expand Down Expand Up @@ -70,7 +72,35 @@ jobs:
pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN";
pnpm nx build sbom;

- name: Upload SBOM artifacts
- name: Install CycloneDX CLI
if: ${{ github.event_name == 'push' || github.event.inputs.SBOM == 'true' }}
shell: bash
run: |
tool_dir="$RUNNER_TEMP/cyclonedx-cli"
mkdir -p "$tool_dir"
curl -fsSL "https://github.com/CycloneDX/cyclonedx-cli/releases/download/v${{ env.CYCLONEDX_CLI_VERSION }}/cyclonedx-linux-x64" -o "$tool_dir/cyclonedx"
echo "${{ env.CYCLONEDX_CLI_LINUX_X64_SHA256 }} $tool_dir/cyclonedx" | sha256sum -c -
chmod +x "$tool_dir/cyclonedx"
echo "$tool_dir" >> "$GITHUB_PATH"
Comment thread
mpreyskurantov marked this conversation as resolved.

- name: Validate SBOMs
if: ${{ github.event_name == 'push' || github.event.inputs.SBOM == 'true' }}
shell: bash
run: |
shopt -s nullglob
sbom_files=(packages/sbom/dist/*.sbom.json)

Comment on lines +139 to +141
Comment on lines +138 to +141
Comment on lines +139 to +141
if [ ${#sbom_files[@]} -eq 0 ]; then
echo "No SBOM files found in packages/sbom/dist"
exit 1
fi

for file in "${sbom_files[@]}"; do
echo "Validating $file"
cyclonedx validate --input-file "$file" --input-format json --fail-on-errors
done

- name: Upload SBOMs
if: ${{ github.event_name == 'push' || github.event.inputs.SBOM == 'true' }}
uses: actions/upload-artifact@v7
with:
Expand Down
30 changes: 29 additions & 1 deletion .github/workflows/packages_publishing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ env:
NX_SKIP_NX_CACHE: true
FILTER: ${{ github.event_name == 'workflow_dispatch' && inputs.filter || '' }}
SET_TIMESTAMP_VERSION: ${{ inputs.tag == 'daily' }}
CYCLONEDX_CLI_VERSION: 0.32.0
CYCLONEDX_CLI_WIN_X64_SHA256: b1c00dbb40e628ec8c1252771871341ac4d4aaf032f832d83bd22cb2b1d258ae

jobs:
build:
Expand Down Expand Up @@ -81,10 +83,36 @@ jobs:
pnpm set "//npm.pkg.github.com/:_authToken" "$env:NODE_AUTH_TOKEN"
pnpm nx build sbom;

- name: Install CycloneDX CLI
shell: bash
run: |
tool_dir="$RUNNER_TEMP/cyclonedx-cli"
mkdir -p "$tool_dir"
curl -fsSL "https://github.com/CycloneDX/cyclonedx-cli/releases/download/v${{ env.CYCLONEDX_CLI_VERSION }}/cyclonedx-win-x64.exe" -o "$tool_dir/cyclonedx.exe"
echo "${{ env.CYCLONEDX_CLI_WIN_X64_SHA256 }} $tool_dir/cyclonedx.exe" | sha256sum -c -
chmod +x "$tool_dir/cyclonedx.exe" || true
Comment thread
mpreyskurantov marked this conversation as resolved.
Outdated
echo "$tool_dir" >> "$GITHUB_PATH"

- name: Validate SBOMs
shell: bash
run: |
shopt -s nullglob
sbom_files=(packages/sbom/dist/*.sbom.json)

if [ ${#sbom_files[@]} -eq 0 ]; then
echo "No SBOM files found in packages/sbom/dist"
exit 1
fi

for file in "${sbom_files[@]}"; do
echo "Validating $file"
cyclonedx validate --input-file "$file" --input-format json --fail-on-errors
done

- name: Build artifacts package
run: pnpm run make-artifacts-package

- name: Upload SBOM artifact
- name: Upload SBOMs
uses: actions/upload-artifact@v7
with:
name: sbom
Expand Down
Loading