CycloneDX for Go GitHub Action | Automate SBOM Generation for Go Projects!
Description
In this video we review how to use a Github action to generate a CycloneDX SBOM for your Go project. Create a workflow to generate SBOMs in a JSON format for your Go project and extract them as an artifact or commit to your repository.
Chapters
0:00 Intro
0:17 Adding Commit Permissions
1:13 Setup Workflow
1:45 Commit to Repo and Upload Artifact
2:16 Viewing the SBOM Results
2:44 Final Thoughts
2:54 Thank You for Watching!
Example Source Code
name: Generate SBOM
on: [push]
jobs:
build:
runs-on: ubuntu-latest
steps:
uses: actions/checkout@v2
name: Set up Go
uses: actions/setup-go@v2
with:
go-version: '1.17'
name: Generate SBOM
uses: CycloneDX/gh-gomod-generate-sbom@v2
with:
version: v1
args: mod -licenses -json -output bom.json
name: Upload SBOM as Artifact
uses: actions/upload-artifact@v2
with:
name: SBOM
path: bom.json
name: Commit SBOM to Repository
run: |
git config --local user.email "[email protected]"
git config --local user.name "GitHub Action"
git add bom.json
git commit -m "Update SBOM" || echo "No changes to commit"
git push
Resources
🎯 GitHub: https://github.com/CycloneDX/gh-gomod...
🎯 Learn More About CycloneDX: https://cyclonedx.org/
More Great SBOM Resources!
🌐 https://learnsbom.com
Contact Us!
📨 [email protected]
#sbom #cyclonedx #cicd #go