From 571b048a0be2dc78c7f364cfcc1a652d69f7a5ac Mon Sep 17 00:00:00 2001 From: Oliver Grueneberg Date: Tue, 22 Sep 2026 14:38:16 +0200 Subject: [PATCH 1/5] chore: add initial sbom upload workflow Generate the SBOM first without upload for testing SBOM creation. Assisted-by: Devin --- .github/workflows/sbom-upload.yml | 60 +++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/sbom-upload.yml diff --git a/.github/workflows/sbom-upload.yml b/.github/workflows/sbom-upload.yml new file mode 100644 index 0000000..e35fe55 --- /dev/null +++ b/.github/workflows/sbom-upload.yml @@ -0,0 +1,60 @@ +# SPDX-FileCopyrightText: 2025 Mercedes-Benz Group AG and Mercedes-Benz AG +# +# SPDX-License-Identifier: Apache-2.0 + +name: Upload SBOM to Dependency Track + +on: + workflow_dispatch: + inputs: + project_version: + description: > + Version label to create in Dependency Track. + Leave empty to use the current commit SHA. + required: false + type: string + +jobs: + sbom-upload: + name: Generate and Upload SBOM + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.mod + cache: true + + - name: Determine project version + id: version + # Use the explicit input when provided, fall back to the full commit SHA. + run: | + if [ -n "${{ inputs.project_version }}" ]; then + echo "value=${{ inputs.project_version }}" >> "$GITHUB_OUTPUT" + else + echo "value=${{ github.sha }}" >> "$GITHUB_OUTPUT" + fi + + - name: Install cyclonedx-gomod + # Pin to the same tool version used to generate the committed SBOMs. + run: go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.12.0 + + - name: Generate CycloneDX SBOM + run: | + cyclonedx-gomod app \ + -main . \ + -json \ + -output sbom.cyclonedx.json + + - name: Upload SBOM as artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sbom-${{ steps.version.outputs.value }} + path: sbom.cyclonedx.json + if-no-files-found: error + retention-days: 90 + From 35b3a470f59a9d0d2a42903ebfd6139f4f96427b Mon Sep 17 00:00:00 2001 From: Oliver Grueneberg Date: Tue, 22 Sep 2026 14:48:11 +0200 Subject: [PATCH 2/5] chore: use newer golang version in action use newer version in actions/setup-go as required by cyclonedx-gomod --- .github/workflows/sbom-upload.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/sbom-upload.yml b/.github/workflows/sbom-upload.yml index e35fe55..6481a07 100644 --- a/.github/workflows/sbom-upload.yml +++ b/.github/workflows/sbom-upload.yml @@ -26,7 +26,7 @@ jobs: - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version-file: go.mod + go-version: 1.27.1 cache: true - name: Determine project version From 68f0024bb67e89b7b8620e2dcaf514a4d3b915ad Mon Sep 17 00:00:00 2001 From: Oliver Grueneberg Date: Tue, 22 Sep 2026 15:00:31 +0200 Subject: [PATCH 3/5] chore: add upload step --- .github/workflows/sbom-upload.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/sbom-upload.yml b/.github/workflows/sbom-upload.yml index 6481a07..4d05650 100644 --- a/.github/workflows/sbom-upload.yml +++ b/.github/workflows/sbom-upload.yml @@ -13,6 +13,15 @@ on: Leave empty to use the current commit SHA. required: false type: string + staging: + description: > + Whether to upload the SBOM to the staging environment. + required: false + type: boolean + default: true + +permissions: + id-token: write jobs: sbom-upload: @@ -50,6 +59,13 @@ jobs: -json \ -output sbom.cyclonedx.json + - uses: eclipse-csi/workflows/upload-sbom@d83da6f2897e985d9d2b9541174c7ee5ee6d88ad # releases do not exist + with: + sbom-file: 'sbom.cyclonedx.json' + product-name: 'disuko-cli' + product-version: ${{ steps.version.outputs.value }} + staging: ${{ inputs.staging }} + - name: Upload SBOM as artifact uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: From b41429b4b619f663e723c0c2898fd30922c665fb Mon Sep 17 00:00:00 2001 From: Oliver Grueneberg Date: Wed, 23 Sep 2026 11:09:07 +0200 Subject: [PATCH 4/5] chore: add input for upload --- .github/workflows/sbom-upload.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/sbom-upload.yml b/.github/workflows/sbom-upload.yml index 4d05650..5947c6c 100644 --- a/.github/workflows/sbom-upload.yml +++ b/.github/workflows/sbom-upload.yml @@ -19,6 +19,12 @@ on: required: false type: boolean default: true + upload: + description: > + Whether to upload the SBOM to Dependency Track. + required: false + type: boolean + default: false permissions: id-token: write @@ -60,6 +66,7 @@ jobs: -output sbom.cyclonedx.json - uses: eclipse-csi/workflows/upload-sbom@d83da6f2897e985d9d2b9541174c7ee5ee6d88ad # releases do not exist + if: ${{ inputs.upload }} with: sbom-file: 'sbom.cyclonedx.json' product-name: 'disuko-cli' From df87c10e2fda72ab3249acb5990967d2a24d5251 Mon Sep 17 00:00:00 2001 From: Oliver Grueneberg Date: Wed, 23 Sep 2026 11:23:54 +0200 Subject: [PATCH 5/5] chore: remove staging input Remove staging input from sbom upload workflow as we do not have the permission to upload out sboms there --- .github/workflows/sbom-upload.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/workflows/sbom-upload.yml b/.github/workflows/sbom-upload.yml index 5947c6c..7573e8b 100644 --- a/.github/workflows/sbom-upload.yml +++ b/.github/workflows/sbom-upload.yml @@ -13,18 +13,12 @@ on: Leave empty to use the current commit SHA. required: false type: string - staging: - description: > - Whether to upload the SBOM to the staging environment. - required: false - type: boolean - default: true upload: description: > Whether to upload the SBOM to Dependency Track. required: false type: boolean - default: false + default: true permissions: id-token: write