diff --git a/.github/workflows/msft-sbom-tool.yml b/.github/workflows/msft-sbom-tool.yml new file mode 100644 index 0000000..f30430b --- /dev/null +++ b/.github/workflows/msft-sbom-tool.yml @@ -0,0 +1,28 @@ +name: Microsoft SBOM Tool demo + +on: + push: + branches: ["main"] + +jobs: + scan: + name: Create SBOM of .NET solution + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + - name: Setup .NET + uses: actions/setup-dotnet@v2 + with: + dotnet-version: 8.0.x + - name: Build + run: dotnet build src/ReactAndAspNetCoreApp.sln --output buildOutput + - name: Generate SBOM + run: | + curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64 + chmod +x $RUNNER_TEMP/sbom-tool + $RUNNER_TEMP/sbom-tool generate -b ./buildOutput -bc . -pn Test -pv 0.0.1 -ps ArbitraryCompany -nsb https://sbom.arbitrary.com -V Verbose + - name: Upload a Build Artifact + uses: actions/upload-artifact@v3.1.0 + with: + path: buildOutput