Skip to content

Add SBOM generation workflow #195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stefichjo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add SBOM generation workflow #195

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .github/workflows/create_sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: Create SBOM
run-name: create-sbom

on:
push:
branches: [main]

permissions:
contents: read

jobs:
sbom:
runs-on: ubuntu-latest
name: Generate SBOM with cdxgen
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false

- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
with:
node-version: "24"
Comment on lines +21 to +24

@coderabbitai coderabbitai Bot Apr 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Is Node.js version 24 released and stable as of April 2026?

💡 Result:

Yes, Node.js version 24 was released on May 6, 2025, and as of April 1, 2026, it is stable and in Active LTS status. It has received multiple updates, including version 24.14.1 released on March 24, 2026, with ongoing security and maintenance support until at least October 2026 (Active LTS) and security fixes until April 2028.

Citations:

🏁 Script executed:

# Check if .node-version file exists and its content
if [ -f ".node-version" ]; then
  echo "=== .node-version file found ==="
  cat .node-version
else
  echo ".node-version file NOT found"
fi

Repository: MaibornWolff/ProjectCanvas

Length of output: 125

🏁 Script executed:

# Also check the workflow file for context
cat -n .github/workflows/create_sbom.yml | head -30

Repository: MaibornWolff/ProjectCanvas

Length of output: 939

Node version mismatch with project standard.

The workflow uses Node.js version "24", but the repository's .node-version file specifies v18.16.0. This version mismatch can cause cdxgen to resolve packages differently than the project's actual toolchain, resulting in an SBOM that doesn't reflect the true dependency tree.

Use .node-version-file to ensure the SBOM is generated with the project's standard Node version:

Proposed fix 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: "24"
+          node-version-file: ".node-version"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
with:
node-version: "24"
- name: Setup Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
with:
node-version-file: ".node-version"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/create_sbom.yml around lines 21 - 24, The workflow step
"Setup Node.js" currently pins node-version: "24" which conflicts with the
repo's .node-version (v18.16.0); update the actions/setup-node step (the one
using actions/setup-node@...) to use the node-version-file input pointing to
".node-version" (replace or remove the hardcoded node-version field) so the
runner installs the project's standard Node version when generating the SBOM.


- name: Install cdxgen
run: npm install -g @cyclonedx/cdxgen@12.1.3

- name: Generate SBOM
run: cdxgen -o sbom.json --spec-version 1.5

- name: Upload SBOM as artifact
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
with:
name: sbom
path: sbom.json