Add a GitHub workflow that resolves dependencies and generates SBOMS … #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Generate SBOMS | |
| on: [push, pull_request] | |
| jobs: | |
| generate-sboms: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Build the Docker image from local Dockerfile | |
| run: docker build -t local-image . | |
| - name: Run pip freeze inside the built Docker container | |
| run: docker run --rm local-image pip freeze --all --exclude scancodeio > scancode-inputs/requirements.txt | |
| - name: Resolve the dependencies using ScanCode-action | |
| uses: nexB/scancode-action@alpha | |
| with: | |
| pipelines: "resolve_dependencies:DynamicResolver" |