Generate SBOM (securego#655)

* Generate SBOM * Update release.yml * Update .github/workflows/release.yml Co-authored-by: Matthieu MOREL <mmorel-35@users.noreply.github.com> * Publish bom.json * Ignore SBOMs generated during CI Co-authored-by: Matthieu MOREL <mmorel-35@users.noreply.github.com>
knightyzl · Jun 21, 2021 · 5032f99 · 5032f99
1 parent 03e8767
commit 5032f99
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -21,6 +21,13 @@ jobs:
       - name : Get release version
         id: get_version
         run: echo ::set-env name=RELEASE_VERSION::$(echo ${GITHUB_REF:10})
+      - name: Generate SBOM
+        uses: CycloneDX/gh-gomod-generate-sbom@v0.2.0
+        with:
+          json: true
+          output: bom.json
+          resolve-licenses: true
+          version: latest
       - name: Release Binaries
         uses: goreleaser/goreleaser-action@v2
         with:

diff --git a/.gitignore b/.gitignore
@@ -33,3 +33,6 @@ _testmain.go
 .DS_Store
 
 .vscode
+
+# SBOMs generated during CI
+/bom.json
diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -2,6 +2,8 @@
 project_name: gosec
 
 release:
+  extra_files:
+    - glob: ./bom.json
   github:
     owner: securego
     name: gosec