Add sbom:generate npm script using CycloneDX format
Add GitHub Actions workflow (.github/workflows/sbom.yml) to auto-generate SBOM
SBOM files (JSON + XML) are uploaded to releases automatically
Why SBOM?
Software Bill of Materials (SBOM) provides:
Supply chain transparency for security audits
Dependency tracking for vulnerability management
Compliance with industry standards (NIST, EO 14028)
Test plan
Run npm run sbom:generate locally to verify output
Trigger workflow manually via workflow_dispatch
Verify SBOM files are uploaded on next release
## Summary
- Add `sbom:generate` npm script using CycloneDX format
- Add GitHub Actions workflow (`.github/workflows/sbom.yml`) to auto-generate SBOM
- SBOM files (JSON + XML) are uploaded to releases automatically
## Why SBOM?
Software Bill of Materials (SBOM) provides:
- Supply chain transparency for security audits
- Dependency tracking for vulnerability management
- Compliance with industry standards (NIST, EO 14028)
## Test plan
- [ ] Run `npm run sbom:generate` locally to verify output
- [ ] Trigger workflow manually via `workflow_dispatch`
- [ ] Verify SBOM files are uploaded on next release
Pull request closed
This pull request cannot be reopened because the branch was deleted.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
sbom:generatenpm script using CycloneDX format.github/workflows/sbom.yml) to auto-generate SBOMWhy SBOM?
Software Bill of Materials (SBOM) provides:
Test plan
npm run sbom:generatelocally to verify outputworkflow_dispatchPull request closed