Added Syft SBOM generation to CD workflow.

2026-05-15 12:35:51 -04:00
parent 362541e13b
commit 85c71faf2d
2 changed files with 31 additions and 0 deletions
@@ -24,10 +24,39 @@ jobs:
      - name: Install dependencies
        run: uv sync --locked

+      - name: Generate package metadata
+        id: metadata
+        run: |
+          version="${{ gitea.ref_name }}"
+          version="${version#v}"
+          printf 'version=%s\n' "$version" | tee -a "$GITEA_OUTPUT"
+
      - name: Build package
        run: uv build

+      - name: Generate SBOM
+        env:
+          SYFT_CHECK_FOR_APP_UPDATE: "false"
+        run: |
+          syft scan dir:. \
+            --override-default-catalogers python-package-cataloger \
+            --source-name git.logal.dev/LogalDeveloper/Crabstero \
+            --source-version "${{ steps.metadata.outputs.version }}" \
+            --output syft-table \
+            --output cyclonedx-json=crabstero-${{ steps.metadata.outputs.version }}.cyclonedx.json
+          sha256sum crabstero-${{ steps.metadata.outputs.version }}.cyclonedx.json
+          zstd -T0 --ultra -22 \
+            crabstero-${{ steps.metadata.outputs.version }}.cyclonedx.json
+
      - name: Publish package
        run: uv publish
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
+
+      - name: Upload SBOM artifact
+        uses: christopherhx/gitea-upload-artifact@8818363695ca2d5782c64f6453273341374767b7 # v7
+        with:
+          name: crabstero-cyclonedx-${{ steps.metadata.outputs.version }}
+          path: crabstero-${{ steps.metadata.outputs.version }}.cyclonedx.json.zst
+          if-no-files-found: error
+          archive: "false"