Add SBOM generation workflow using Trivy (SPDX JSON)#100

Merged

vrane-tibco merged 13 commits intomainfrom

feature/sbom-generation

Mar 24, 2026

Commits on Mar 24, 2026

Add SBOM generation workflow using Trivy (SPDX JSON)
vrane-tibco
committed
Test: trigger SBOM workflow on feature/sbom-generation push
vrane-tibco
committed
Fix: replace softprops/action-gh-release with gh CLI for release asset upload
vrane-tibco
committed
Fix: update Trivy version from non-existent 0.68.2 to 0.69.3
vrane-tibco
committed
Fix: remove invalid trivy flags; add patch_sbom.py to set SPDX metadata post-scan
vrane-tibco
committed
Fix: unzip path and skip wheel SBOM steps when no wheel built
vrane-tibco
committed
Fix: remove windows-latest from wheel SBOM matrix (cannot cross-compile)
vrane-tibco
committed
Fix: add --name argument to patch_sbom.py to set correct SPDX document name
vrane-tibco
committed
Fix: checkout submodules recursively so vendor/sbdf-c/include/all.h is available when building sdist/wheel
vrane-tibco
committed
Fix: clean SBOM output - strip synthetic pkgs, test files, noise; fix name/namespace from wheel tags
vrane-tibco
committed
Fix: scan requirements.txt with --scanners license --license-full instead of site-packages dir
vrane-tibco
committed
Fix: remove requirements.txt synthetic APPLICATION package; promote CONTAINS to DOCUMENT DESCRIBES
vrane-tibco
committed
Cleanup: remove test push trigger before merging to main
vrane-tibco
committed