From 759d9a183ad6086b11a436d9ec51aff06ce6918a Mon Sep 17 00:00:00 2001 From: riley206-pnnl Date: Wed, 22 Jul 2026 17:10:12 -0700 Subject: [PATCH 1/4] Add SBOMs to prereleases --- .github/workflows/deploy-pre-release.yml | 28 +++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-pre-release.yml b/.github/workflows/deploy-pre-release.yml index 64e7c0c..654b3e5 100644 --- a/.github/workflows/deploy-pre-release.yml +++ b/.github/workflows/deploy-pre-release.yml @@ -186,6 +186,32 @@ jobs: echo "New tag will be: ${NEW_TAG}" echo "source branch is ${{ github.ref_name }}" + # ---------------------------------------------- + # Generate release security metadata + # ---------------------------------------------- + - name: Set up Node.js + if: env.no_changes == 'false' + uses: actions/setup-node@v4 + with: + node-version: '20' + + - name: Install SBOM tools + if: env.no_changes == 'false' + run: | + npm install -g @cyclonedx/cdxgen + pip install owasp-depscan + + - name: Generate SBOM and vulnerability report + if: env.no_changes == 'false' + run: | + cdxgen -t python . + depscan --bom bom.json + mkdir sbom-reports + cp bom.json sbom-reports/ + for report in bom.vdr.json depscan-bom.json reports/*; do + [[ -f "$report" ]] && cp "$report" sbom-reports/ + done + # ---------------------------------------------- # Auto commit toml file (only if version was bumped) # ---------------------------------------------- @@ -210,7 +236,7 @@ jobs: if: env.no_changes == 'false' uses: ncipollo/release-action@v1 with: - artifacts: "dist/*.gz,dist/*.whl" + artifacts: "dist/*.gz,dist/*.whl,sbom-reports/*" artifactErrorsFailBuild: true generateReleaseNotes: true commit: develop From a7b4e4b987f590b37f7a9d029113e7b2d8844fae Mon Sep 17 00:00:00 2001 From: riley206-pnnl Date: Wed, 22 Jul 2026 17:25:33 -0700 Subject: [PATCH 2/4] Allow prerelease SBOM generation without depscan report --- .github/workflows/deploy-pre-release.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy-pre-release.yml b/.github/workflows/deploy-pre-release.yml index 654b3e5..166db93 100644 --- a/.github/workflows/deploy-pre-release.yml +++ b/.github/workflows/deploy-pre-release.yml @@ -205,7 +205,9 @@ jobs: if: env.no_changes == 'false' run: | cdxgen -t python . - depscan --bom bom.json + if ! depscan --bom bom.json; then + echo "depscan could not generate a vulnerability report; continuing with the SBOM." + fi mkdir sbom-reports cp bom.json sbom-reports/ for report in bom.vdr.json depscan-bom.json reports/*; do From 2331dfa81a77ca55faed28bc3deb15ffdb19a24f Mon Sep 17 00:00:00 2001 From: riley206-pnnl Date: Thu, 23 Jul 2026 11:52:48 -0700 Subject: [PATCH 3/4] Require vulnerability reports for prereleases --- .github/workflows/deploy-pre-release.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy-pre-release.yml b/.github/workflows/deploy-pre-release.yml index 166db93..0cc7713 100644 --- a/.github/workflows/deploy-pre-release.yml +++ b/.github/workflows/deploy-pre-release.yml @@ -201,13 +201,17 @@ jobs: npm install -g @cyclonedx/cdxgen pip install owasp-depscan + - name: Download vulnerability database + if: env.no_changes == 'false' + env: + VDB_APP_ONLY_DATABASE_URL: ghcr.io/appthreat/vdbxz-app-extended:v6.7.x + run: vdb --download-image + - name: Generate SBOM and vulnerability report if: env.no_changes == 'false' run: | cdxgen -t python . - if ! depscan --bom bom.json; then - echo "depscan could not generate a vulnerability report; continuing with the SBOM." - fi + depscan --bom bom.json mkdir sbom-reports cp bom.json sbom-reports/ for report in bom.vdr.json depscan-bom.json reports/*; do From 81a0d96e20e86e98cdbc547da87fc4783049a4f9 Mon Sep 17 00:00:00 2001 From: riley206-pnnl Date: Thu, 23 Jul 2026 13:04:33 -0700 Subject: [PATCH 4/4] Reuse prerelease SBOM report directory --- .github/workflows/deploy-pre-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy-pre-release.yml b/.github/workflows/deploy-pre-release.yml index 0cc7713..fd21a54 100644 --- a/.github/workflows/deploy-pre-release.yml +++ b/.github/workflows/deploy-pre-release.yml @@ -212,7 +212,7 @@ jobs: run: | cdxgen -t python . depscan --bom bom.json - mkdir sbom-reports + mkdir -p sbom-reports cp bom.json sbom-reports/ for report in bom.vdr.json depscan-bom.json reports/*; do [[ -f "$report" ]] && cp "$report" sbom-reports/