Add workflow to generate SBOM (software bill of materials) #561

.github/workflows/bom.yml

@@ -0,0 +1,43 @@
+name: SBOM
+
+on:
+  push:
+    branches: [main]
+
+  workflow_dispatch:
+
+jobs:
+  bom:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [18]
+
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/checkout@v3
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.version }}
+          cache: "npm"
+
+      - name: Install @cyclonedx/cyclonedx-npm
+        run: npm install @cyclonedx/cyclonedx-npm --no-save
+
+      - name: Generate BOM
+        run: npm exec -- cyclonedx-npm --output-format XML --output-file bom.xml
+
+      - name: Push BOM to Dependency Track
+        env:
+          PROJECT_NAME: bkd-webapp-schulverwaltung
+        run: |
+          curl --verbose -s --location --request POST ${{vars.DEPENDENCY_TRACK_URL}}/api/v1/bom \
+               --header "X-Api-Key: ${{secrets.DEPENDENCY_TRACK_API_KEY}}" \
+               --header "Content-Type: multipart/form-data" \
+               --form "autoCreate=true" \
+               --form "projectName=$PROJECT_NAME" \
+               --form "projectVersion=latest" \
+               --form "[email protected]"

README.md

@@ -2,6 +2,7 @@
 
 [![lint test ✨](https://github.com/bkd-mba-fbi/webapp-schulverwaltung/actions/workflows/lintAndTest.yml/badge.svg?branch=main)](https://github.com/bkd-mba-fbi/webapp-schulverwaltung/actions/workflows/lintAndTest.yml)
 [![build 🏭 deploy 🚀](https://github.com/bkd-mba-fbi/webapp-schulverwaltung/actions/workflows/buildDeploy.yml/badge.svg)](https://github.com/bkd-mba-fbi/webapp-schulverwaltung/actions/workflows/buildDeploy.yml)
+[![SBOM](https://github.com/bkd-mba-fbi/webapp-schulverwaltung/actions/workflows/bom.yml/badge.svg?branch=main)](https://github.com/bkd-mba-fbi/webapp-schulverwaltung/actions/workflows/bom.yml)
 
 JavaScript web module to implement processes for school administration using the SLH.Evento backend (REST API).