Create sbom.yml

[mm-psy]

No description provided.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	08eba0b27e820071cde6df949e0beb9ba4906955	🟢 6.3	Details Check Score Reason Maintained ⚠️ 3 4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 9 security policy file detected Pinned-Dependencies ⚠️ 3 dependency not pinned by hash detected -- score normalized to 3 Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Vulnerabilities 🟢 9 1 existing vulnerabilities detected SAST 🟢 8 SAST tool detected but not run on all commits
actions/actions/upload-artifact	4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1	🟢 5.5	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 6 8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Vulnerabilities ⚠️ 4 6 existing vulnerabilities detected SAST 🟢 8 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/sbom.yml

[Copilot]

Pull request overview

This PR introduces automated Software Bill of Materials (SBOM) generation using CycloneDX's cdxgen tool. The workflow triggers on pushes to main/release branches and version tags, generating an SBOM artifact for dependency tracking and security compliance.

Key changes:

• New GitHub Actions workflow that runs on push events to main, release branches, and version tags
• Integration of CycloneDX cdxgen tool via Docker to generate SBOM in JSON format
• Automatic artifact upload of generated SBOM for downstream consumption

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The Docker command uses $(pwd) for volume mounting, which can fail in GitHub Actions runners and poses a potential security risk by mounting the entire workspace with read-write permissions. Use ${{ github.workspace }} instead and consider using read-only mounting (:ro) for the source directory.

Suggested change

	run: docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o /tmp/bom.json
	run: docker run --rm -v /tmp:/tmp -v ${{ github.workspace }}:/app:ro -t ghcr.io/cyclonedx/cdxgen -r /app -o /tmp/bom.json

[Copilot]

The cdxgen Docker image is not pinned to a specific version or digest, which can lead to unpredictable behavior and potential security issues. Pin the image to a specific version tag or SHA256 digest (e.g., ghcr.io/cyclonedx/cdxgen@sha256:... or ghcr.io/cyclonedx/cdxgen:v10.0.0).

Suggested change

	run: docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o /tmp/bom.json
	run: docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen:v10.0.0 -r /app -o /tmp/bom.json

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.