.github/workflows/sca-integration-ort.yml #130

	name: Generate SBOM with ORT and load into ScanCode.io

	# This workflow:
	# 1. Generates a CycloneDX SBOM for a requirement.txt file using ORT.
	# 2. Uploads the SBOM as a GitHub artifact for future inspection.
	# 3. Loads the SBOM into ScanCode.io for further analysis.
	# 4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
	#
	# It runs on demand, and once a week (scheduled).

	on:
	workflow_dispatch:
	schedule:
	# Run once a week (every 7 days) at 00:00 UTC on Sunday
	- cron: "0 0 * * 0"

	permissions:
	contents: read

	env:
	EXPECTED_PACKAGE: 5
	EXPECTED_VULNERABLE_PACKAGE: 1
	EXPECTED_DEPENDENCY: 1

	jobs:
	generate-and-load-sbom:
	runs-on: ubuntu-24.04
	steps:
	- name: Create a Python requirements.txt
	run: \|
	cat << 'EOF' > requirements.txt
	amqp==5.1.1
	appdirs==1.4.4
	asgiref==3.5.2
	urllib3==1.26.0
	EOF

	- name: Run GitHub Action for ORT
	uses: oss-review-toolkit/ort-ci-github-action@v1

	- name: Import SBOM into ScanCode.io
	uses: aboutcode-org/scancode-action@main
	with:
	pipelines: "load_sbom"
	inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
	scancodeio-repo-branch: "main"

	- name: Verify SBOM Analysis Results in ScanCode.io
	shell: bash
	run: \|
	scanpipe verify-project \
	--project scancode-action \
	--packages ${{ env.EXPECTED_PACKAGE }} \
	--vulnerable-packages ${{ env.EXPECTED_VULNERABLE_PACKAGE }} \
	--dependencies ${{ env.EXPECTED_DEPENDENCY }}

Provide feedback