Skip to content

Latest commit

 

History

History
17 lines (12 loc) · 1.12 KB

README.md

File metadata and controls

17 lines (12 loc) · 1.12 KB

PA2588 DevSecOps: Playground for SBOM (Software Bill of Material)

This is part of the course DevSecOps. You will see how to create a SBOM in your development process.

Preparation

  1. Click on Use this template to create a new repository in your GitHub account (don't fork it), and make sure to set the visibility to "Public".
    • The GitHub actions should run automatically and be green.

Enable SBOM in your Pipeline

  1. In .github/workflows/sbom.yml, uncomment the block labeled "Version 1" to enable the creation of a Software Bill of Materials.
    • After the next successful run of the GitHub actions, under the created Artifacts, you should now see a "*.spdx.json" file contains the names, versions, and license information for all pieces of software contained within the Docker image.
  2. Create a new "Release" on GitHub based on the current version of the main branch.
    • After the next successful run of the GitHub actions, you will find the "*.spdx.json" file automatically attached to the release notes.