feat: add SBOM generation for supply chain transparency #510

Closed
ZacharyZcR wants to merge 1 commits from feat/sbom into dev-1.10.1
ZacharyZcR commented 2026-01-14 19:02:11 +00:00 (Migrated from github.com)

Summary

  • Add sbom:generate npm script using CycloneDX format
  • Add GitHub Actions workflow (.github/workflows/sbom.yml) to auto-generate SBOM
  • SBOM files (JSON + XML) are uploaded to releases automatically

Why SBOM?

Software Bill of Materials (SBOM) provides:

  • Supply chain transparency for security audits
  • Dependency tracking for vulnerability management
  • Compliance with industry standards (NIST, EO 14028)

Test plan

  • Run npm run sbom:generate locally to verify output
  • Trigger workflow manually via workflow_dispatch
  • Verify SBOM files are uploaded on next release
## Summary - Add `sbom:generate` npm script using CycloneDX format - Add GitHub Actions workflow (`.github/workflows/sbom.yml`) to auto-generate SBOM - SBOM files (JSON + XML) are uploaded to releases automatically ## Why SBOM? Software Bill of Materials (SBOM) provides: - Supply chain transparency for security audits - Dependency tracking for vulnerability management - Compliance with industry standards (NIST, EO 14028) ## Test plan - [ ] Run `npm run sbom:generate` locally to verify output - [ ] Trigger workflow manually via `workflow_dispatch` - [ ] Verify SBOM files are uploaded on next release

Pull request closed

Sign in to join this conversation.