Skip to content

Commit

Permalink
Generage SBOM for every release
Browse files Browse the repository at this point in the history
Fixes #3805
  • Loading branch information
ocelotl committed Mar 22, 2024
1 parent 694445f commit 74c46e7
Show file tree
Hide file tree
Showing 2 changed files with 74 additions and 0 deletions.
19 changes: 19 additions & 0 deletions .github/workflows/generate_sbom.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
from requests import get
from json import dumps

with open("opentelemetry-python.spdx.json", "w") as sbom_file:
sbom_file.write(
dumps(
get(
(
"https://api.github.com/repos/open-telemetry/"
"opentelemetry-python/dependency-graph/sbom"
),
headers={
"Accept": "application/vnd.github+json",
"X-GitHub-Api-Version": "2022-11-28"
}
).json(),
indent=4
)
)
55 changes: 55 additions & 0 deletions .github/workflows/sbom.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: SBOM
on:
release:
types: [published]

permissions: read-all

jobs:
generate-sbom:
runs-on: ubuntu-latest
steps:
- name: Checkout core repo
uses: actions/checkout@v4

- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: '3.10'
architecture: 'x64'

- name: Install requests
run: pip install requests

- name: Generate SBOM
run: python3 .github/workflows/generate_sbom.py

- name: Zip the SBOM file
run: zip sbom.zip opentelemetry-python.spdx.json

- name: Upload artifact
uses: actions/upload-artifact@v4
with:
name: SBOM.zip
path: ./sbom.zip

add-release-artifact:
needs: generate-sbom
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Download artifact from generate-sboms
uses: actions/download-artifact@v4
with:
name: SBOM.zip

- name: Upload release asset
uses: actions/upload-release-asset@v1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
upload_url: ${{ github.event.release.upload_url }}
asset_path: ./sbom.zip
asset_name: SBOM.zip
asset_content_type: application/zip

0 comments on commit 74c46e7

Please sign in to comment.