Skip to content

feat(ci): add automated SBOM generation workflow - #236

Open
AnzalKhan16 wants to merge 3 commits into
optiqor:mainfrom
AnzalKhan16:feat/add-sbom-workflow
Open

feat(ci): add automated SBOM generation workflow#236
AnzalKhan16 wants to merge 3 commits into
optiqor:mainfrom
AnzalKhan16:feat/add-sbom-workflow

Conversation

@AnzalKhan16

@AnzalKhan16 AnzalKhan16 commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

What

This pull request adds a dedicated GitHub Actions workflow (sbom.yml) to automatically generate a Software Bill of Materials (SBOM) using Syft and upload it as a workflow artifact.

Why

Fixes #235

Generating an SBOM improves software supply chain transparency and provides a standardized inventory of project dependencies, aligning the project with modern DevSecOps best practices.

How

  • Added a new sbom.yml workflow.
  • Checks out the repository.
  • Installs Syft.
  • Generates an SPDX-formatted SBOM.
  • Uploads the generated SBOM as a GitHub Actions artifact.

Testing

  • go build ./... passes
  • go test ./... passes
  • go vet ./... passes
  • golangci-lint run ./... passes
  • N/A — workflow-only change (no application or eBPF code modified)

Checklist

  • PR title follows Conventional Commits (feat(ci): ...)
  • All commits are DCO-signed
  • No unrelated changes pulled in
  • Documentation updated where user-visible behavior changed
  • Added/updated tests for new code paths
  • No doctor rule changes

@AnzalKhan16
AnzalKhan16 requested a review from btwshivam as a code owner July 3, 2026 11:29
@github-actions github-actions Bot added testing Tests and test coverage level:critical Touches BPF, security, or release surfaces (auto-applied) labels Jul 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

level:critical Touches BPF, security, or release surfaces (auto-applied) testing Tests and test coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: Add Software Bill of Materials (SBOM) Generation to the CI Pipeline

1 participant