Add SBOM pipeline

.github/workflows/publish.yml

@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+  packages: read
   id-token: write
 
 jobs:
@@ -20,16 +21,19 @@ jobs:
 
     steps:
       - name: Get sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            tools/make-sbom/pnpm-lock.yaml
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
@@ -46,8 +50,41 @@ jobs:
           package_cli_tgz="$(pnpm --filter devextreme-cli pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
           package_schematics_tgz="$(pnpm --filter devextreme-schematics pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
 
-          echo "PACKAGE_CLI_TGZ=$package_cli_tgz" >> "$GITHUB_ENV"
-          echo "PACKAGE_SCHEMATICS_TGZ=$package_schematics_tgz" >> "$GITHUB_ENV"
+          echo "PACKAGE_CLI_TGZ=$(realpath "$package_cli_tgz")" >> "$GITHUB_ENV"
+          echo "PACKAGE_SCHEMATICS_TGZ=$(realpath "$package_schematics_tgz")" >> "$GITHUB_ENV"
+
+      - name: Upload packages
+        uses: actions/upload-artifact@v7
+        with:
+          name: packages
+          path: |
+            ${{ env.PACKAGE_CLI_TGZ }}
+            ${{ env.PACKAGE_SCHEMATICS_TGZ }}
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Build SBOMs
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN"
+          cd tools/make-sbom && pnpm install --frozen-lockfile && pnpm dx-make-sbom ../../ dist/ "devextreme-cli($PACKAGE_CLI_TGZ),devextreme-schematics($PACKAGE_SCHEMATICS_TGZ)"
+
+      - name: Upload SBOMs
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom
+          path: tools/make-sbom/dist
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Validate SBOMs
+        uses: mpreyskurantov/github-actions/validate-sbom@sbom-val-dev
+        with:
+          input-format: json
+          input-files: |
+            tools/make-sbom/dist/devextreme-cli.cdx.json
+            tools/make-sbom/dist/devextreme-schematics.cdx.json
 
       - name: Publish devextreme-cli
         run: pnpm publish "$PACKAGE_CLI_TGZ" --provenance ${{ inputs['dry-run'] && '--dry-run' || '' }}

.github/workflows/sbom.yml

@@ -0,0 +1,88 @@
+name: SBOM
+
+on:
+  push:
+    branches:
+      - sbom-dev
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  sbom:
+    if: ${{ github.event_name == 'push' && github.ref_type == 'branch' && github.ref_name == 'sbom-dev' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Get sources
+        uses: actions/checkout@v6
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Use Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: '.node-version'
+          cache: 'pnpm'
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            tools/make-sbom/pnpm-lock.yaml
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Test devextreme-schematics
+        run: pnpm --filter devextreme-schematics run test
+
+      - name: Build devextreme-schematics
+        run: pnpm --filter devextreme-schematics run build
+
+      - name: Pack packages
+        run: |
+          package_cli_tgz="$(pnpm --filter devextreme-cli pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
+          package_schematics_tgz="$(pnpm --filter devextreme-schematics pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
+
+          echo "PACKAGE_CLI_TGZ=$(realpath "$package_cli_tgz")" >> "$GITHUB_ENV"
+          echo "PACKAGE_SCHEMATICS_TGZ=$(realpath "$package_schematics_tgz")" >> "$GITHUB_ENV"
+
+      - name: Upload packages
+        uses: actions/upload-artifact@v7
+        with:
+          name: packages
+          path: |
+            ${{ env.PACKAGE_CLI_TGZ }}
+            ${{ env.PACKAGE_SCHEMATICS_TGZ }}
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Build SBOMs
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN"
+          cd tools/make-sbom && pnpm install --frozen-lockfile && pnpm dx-make-sbom ../../ dist/ "devextreme-cli($PACKAGE_CLI_TGZ),devextreme-schematics($PACKAGE_SCHEMATICS_TGZ)"
+
+      - name: Upload SBOMs
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom
+          path: tools/make-sbom/dist
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Validate SBOMs
+        uses: mpreyskurantov/github-actions/validate-sbom@sbom-val-dev
+        with:
+          input-format: json
+          input-files: |
+            tools/make-sbom/dist/devextreme-cli.cdx.json
+            tools/make-sbom/dist/devextreme-schematics.cdx.json
+
+      - name: Publish devextreme-cli (dry-run)
+        run: pnpm publish "$PACKAGE_CLI_TGZ" --no-git-checks --dry-run
+
+      - name: Publish devextreme-schematics (dry-run)
+        run: pnpm publish "$PACKAGE_SCHEMATICS_TGZ" --no-git-checks --dry-run

.gitignore

@@ -9,6 +9,8 @@
 **/npm-debug.log*
 **/pnpm-debug.log*
 **/yarn-error.log*
+*.tgz
+dist
 packages/devextreme-cli/testing/sandbox/
 packages/devextreme-cli/testing/__tests__/__diff_snapshots__/
 

tools/make-sbom/.npmrc

@@ -0,0 +1 @@
+@devexpress:registry=https://npm.pkg.github.com

tools/make-sbom/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "devextreme-cli-monorepo-sbom",
+  "version": "1.2.7",
+  "packageManager": "pnpm@11.5.2",
+  "private": true,
+  "devDependencies": {
+    "@devexpress/sbom-toolkit": "0.11.2"
+  },
+  "scripts": {
+    "make-sbom": "rm -rf dist/ && pnpm dx-make-sbom ../../ dist/ devextreme-cli,devextreme-schematics"
+  }
+}