SBOM generation to go along w/ every release

[mbiuki]

Parent Issue

No response

Task

We need to automate the generation of Software Bill of Materials (SBOM) using GitHub Actions. This automation should ensure that a new SBOM is generated with each new build and release. The preferred SBOM formats are SPDX and CycloneDX.

Additional Information:

• SPDX Specification
• CycloneDX Specification

Proposed Objective

Security & Privacy

Proposed Priority

Priority 2 - Important

Acceptance Criteria

1. A GitHub Actions workflow is created and triggers on every push to the main branch OR on every release.
2. SBOMs in SPDX and CycloneDX formats are generated and stored in the repository.
3. SBOM files are attached to the release artifacts and indicated hyperlink in the changelog site.
4. The process is documented and easy to understand. Change log should have a hyperlink to the latest and greatest SBOM.

External Links... Slack Conversations, Support Tickets, Figma Designs, etc.

No response

Assumptions & Initiation Needs

No response

Quality Assurance Notes & Workarounds

No response

Sub-Tasks & Estimates

No response

Tasks

Beta Give feedback

1. Create GitHub Actions Workflow
2. Integrate SBOM Generation Tool
3. Store and Attach SBOM
4. Testing and Validation
5. Documentation

[mbiuki]

TODO

Create GitHub Actions Workflow:
Set up a GitHub Actions workflow to run on every push to the main branch and on every release.
The workflow should trigger SBOM generation tools compatible with SPDX and CycloneDX formats.

Integrate SBOM Generation Tool:
Select and integrate an SBOM generation tool that supports SPDX and CycloneDX formats (e.g., Syft, CycloneDX GitHub Action).
Configure the tool to scan the codebase and generate the SBOM.

Store and Attach SBOM:
Save the generated SBOM in the repository.
Attach the SBOM file to the release artifacts.

Testing and Validation:
Test the workflow to ensure SBOM is generated correctly.
Validate the SBOM formats and ensure they meet the required standards.

Documentation:
Document the setup process in the repository’s README or a separate documentation file.
Create a hyperlink in the changelog.
Provide instructions on how to manually trigger the SBOM generation if needed.

[mbiuki]

FYI, @jdcmsd ☝🏻