Repository navigation
Conversation
Add a workflow with two jobs. The sbom job writes one CycloneDX software bill of materials per Go module with cyclonedx-gomod, including the detected license of every dependency. The cbom job runs CBOMkit's source scanner over the Go code and writes a CycloneDX cryptography bill of materials per module plus a consolidated one. Both upload their output as artifacts and write a job summary. It runs on pushes to main, on v* tags, on pull requests that change a go.mod, a go.sum or the workflow itself, and on demand. cmd/node and cmd/tokengen require the EVM network module at a placeholder version without replacing it, so their module graph does not resolve on its own. For such modules the sbom job points in-repo modules at the checkout, in its own copy of go.mod, and says so in a warning and in the summary. The CBOM covers only what CBOMkit's Go rules recognize, which is the standard library and three golang.org/x/crypto packages. The header of the workflow file says what is left out. Assisted-by: anthropic:claude-fable-5-1 Signed-off-by: Ry Jones <ry@linux.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a workflow with two jobs. The sbom job writes one CycloneDX software bill of materials per Go module with cyclonedx-gomod, including the detected license of every dependency. The cbom job runs CBOMkit's source scanner over the Go code and writes a CycloneDX cryptography bill of materials per module plus a consolidated one. Both upload their output as artifacts and write a job summary.
It runs on pushes to main, on v* tags, on pull requests that change a go.mod, a go.sum or the workflow itself, and on demand.
cmd/node and cmd/tokengen require the EVM network module at a placeholder version without replacing it, so their module graph does not resolve on its own. For such modules the sbom job points in-repo modules at the checkout, in its own copy of go.mod, and says so in a warning and in the summary.
The CBOM covers only what CBOMkit's Go rules recognize, which is the standard library and three golang.org/x/crypto packages. The header of the workflow file says what is left out.
Assisted-by: anthropic:claude-fable-5-1