Add SBOM generation workflow#195
Conversation
Adds CycloneDX SBOM generation via cdxgen, triggered on push to main. The SBOM is uploaded as a GitHub Actions artifact.
📝 WalkthroughWalkthroughA new GitHub Actions workflow file was added to automatically generate Software Bill of Materials (SBOM) files on every push to the main branch using CycloneDX's cdxgen tool and upload the results as build artifacts. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/create_sbom.yml (2)
11-36: Consider optional enhancements for workflow efficiency.The workflow is functional, but consider these optional improvements:
- Caching npm packages: Add caching to speed up the cdxgen installation.
- Artifact retention policy: Specify a retention period for the SBOM artifact.
- Alternative approach: Consider using the official CycloneDX GitHub Action if available.
♻️ Optional enhancement: Add npm caching
- name: Setup Node.js uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version-file: ".node-version" + cache: "npm"And add retention policy to the artifact upload:
- name: Upload SBOM as artifact uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 with: name: sbom path: sbom.json + retention-days: 90🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/create_sbom.yml around lines 11 - 36, The workflow job "sbom" can be optimized: add an actions/cache step before "Install cdxgen" to cache the npm global cache (key on node-version and lockfile or package manager), so the "Install cdxgen" run is faster; add a retention-days field to the "uses: actions/upload-artifact" step to set an artifact retention policy for the sbom; optionally replace the "Install cdxgen" + "Generate SBOM" steps with the official CycloneDX GitHub Action if you prefer a maintained action (look for an action named like "cyclonedx/cyclonedx-action") to simplify the "cdxgen" invocation.
26-30: Consider updating cdxgen to version 12.1.4 (latest patch available).Version 12.1.3 exists and is valid, and CycloneDX spec version 1.5 is explicitly supported. However, version 12.1.4 is the current latest patch release. While both work correctly, keeping dependencies on the latest patch version ensures you receive any bug fixes and security updates. The --spec-version 1.5 choice is also valid (versions 1.4–1.7 are supported).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/create_sbom.yml around lines 26 - 30, Update the cdxgen install step to use the latest patch release: change the npm install invocation that currently references "@cyclonedx/cdxgen@12.1.3" to "@cyclonedx/cdxgen@12.1.4" (the "Install cdxgen" step and its run command), leaving the "Generate SBOM" step and its cdxgen CLI flags (cdxgen -o sbom.json --spec-version 1.5) unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/create_sbom.yml:
- Around line 21-24: The workflow step "Setup Node.js" currently pins
node-version: "24" which conflicts with the repo's .node-version (v18.16.0);
update the actions/setup-node step (the one using actions/setup-node@...) to use
the node-version-file input pointing to ".node-version" (replace or remove the
hardcoded node-version field) so the runner installs the project's standard Node
version when generating the SBOM.
---
Nitpick comments:
In @.github/workflows/create_sbom.yml:
- Around line 11-36: The workflow job "sbom" can be optimized: add an
actions/cache step before "Install cdxgen" to cache the npm global cache (key on
node-version and lockfile or package manager), so the "Install cdxgen" run is
faster; add a retention-days field to the "uses: actions/upload-artifact" step
to set an artifact retention policy for the sbom; optionally replace the
"Install cdxgen" + "Generate SBOM" steps with the official CycloneDX GitHub
Action if you prefer a maintained action (look for an action named like
"cyclonedx/cyclonedx-action") to simplify the "cdxgen" invocation.
- Around line 26-30: Update the cdxgen install step to use the latest patch
release: change the npm install invocation that currently references
"@cyclonedx/cdxgen@12.1.3" to "@cyclonedx/cdxgen@12.1.4" (the "Install cdxgen"
step and its run command), leaving the "Generate SBOM" step and its cdxgen CLI
flags (cdxgen -o sbom.json --spec-version 1.5) unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 775db895-d115-459e-be07-171fba09d25a
📒 Files selected for processing (1)
.github/workflows/create_sbom.yml
| - name: Setup Node.js | ||
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 | ||
| with: | ||
| node-version: "24" |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Is Node.js version 24 released and stable as of April 2026?
💡 Result:
Yes, Node.js version 24 was released on May 6, 2025, and as of April 1, 2026, it is stable and in Active LTS status. It has received multiple updates, including version 24.14.1 released on March 24, 2026, with ongoing security and maintenance support until at least October 2026 (Active LTS) and security fixes until April 2028.
Citations:
- 1: https://nodejs.org/en/about/releases/
- 2: https://nodejs.org/en/blog/year-2026
- 3: https://nodejs.org/en/about/previous-releases
- 4: https://nodejs.org/en/blog/release/v24.14.0
- 5: https://versionlog.com/nodejs/24/
- 6: https://nodejs.org/en/about/releases
- 7: https://endoflife.date/nodejs
🏁 Script executed:
# Check if .node-version file exists and its content
if [ -f ".node-version" ]; then
echo "=== .node-version file found ==="
cat .node-version
else
echo ".node-version file NOT found"
fiRepository: MaibornWolff/ProjectCanvas
Length of output: 125
🏁 Script executed:
# Also check the workflow file for context
cat -n .github/workflows/create_sbom.yml | head -30Repository: MaibornWolff/ProjectCanvas
Length of output: 939
Node version mismatch with project standard.
The workflow uses Node.js version "24", but the repository's .node-version file specifies v18.16.0. This version mismatch can cause cdxgen to resolve packages differently than the project's actual toolchain, resulting in an SBOM that doesn't reflect the true dependency tree.
Use .node-version-file to ensure the SBOM is generated with the project's standard Node version:
Proposed fix
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
with:
- node-version: "24"
+ node-version-file: ".node-version"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Setup Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 | |
| with: | |
| node-version: "24" | |
| - name: Setup Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 | |
| with: | |
| node-version-file: ".node-version" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/create_sbom.yml around lines 21 - 24, The workflow step
"Setup Node.js" currently pins node-version: "24" which conflicts with the
repo's .node-version (v18.16.0); update the actions/setup-node step (the one
using actions/setup-node@...) to use the node-version-file input pointing to
".node-version" (replace or remove the hardcoded node-version field) so the
runner installs the project's standard Node version when generating the SBOM.
2 participants
Summary
Test plan
sbom.jsonartifact is producedSummary by CodeRabbit