chore: import upstream snapshot with attribution

2026-07-13 13:08:55 +08:00
commit 7a0da7932b
2985 changed files with 1049377 additions and 0 deletions
@@ -0,0 +1,81 @@
+name: SBOM Generation
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run weekly on Wednesday at 10 AM UTC (staggered with other scans)
+    - cron: '0 10 * * 3'
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  sbom:
+    name: Generate Software Bill of Materials
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+
+    steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      with:
+        egress-policy: audit
+
+    - name: Checkout repository
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+
+    - name: Generate SBOM for source code
+      uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      with:
+        path: .
+        artifact-name: sbom-source.spdx.json
+        output-file: sbom-source.spdx.json
+        format: spdx-json
+
+    - name: Generate SBOM for Python dependencies
+      uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      with:
+        path: .
+        artifact-name: sbom-python.cyclonedx.json
+        output-file: sbom-python.cyclonedx.json
+        format: cyclonedx-json
+
+    - name: Upload SBOMs as artifacts
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: sbom-reports
+        path: |
+          sbom-source.spdx.json
+          sbom-python.cyclonedx.json
+        retention-days: 90
+
+    - name: Display SBOM summary
+      run: |
+        {
+          echo "## SBOM Generation Summary"
+          echo ""
+          echo "### Generated SBOMs"
+          echo "- **Source Code SBOM**: \`sbom-source.spdx.json\` (SPDX format)"
+          echo "- **Dependencies SBOM**: \`sbom-python.cyclonedx.json\` (CycloneDX format)"
+          echo ""
+          echo "### What is an SBOM?"
+          echo "A Software Bill of Materials (SBOM) is a formal record of all components,"
+          echo "libraries, and dependencies used in building software. It enables:"
+          echo ""
+          echo "- **Vulnerability tracking**: Know exactly what's in your software"
+          echo "- **License compliance**: Verify all dependencies have compatible licenses"
+          echo "- **Supply chain security**: Detect compromised dependencies"
+          echo "- **Regulatory compliance**: Meet requirements (EO 14028, etc.)"
+          echo ""
+          echo "### Artifacts"
+          echo "SBOMs are available as workflow artifacts for 90 days."
+          if [ "${{ github.event_name }}" = "release" ]; then
+            echo ""
+            echo "SBOMs have also been attached to the release assets."
+          fi
+        } >> "$GITHUB_STEP_SUMMARY"