Skip to content

Commit 08805fb

Browse files
authored
Add sbom_generation file
This PR adds an [OCI DevOps build specification file](https://docs.oracle.com/en-us/iaas/Content/devops/using/build_specs.htm) that generates a Software Bill of Materials (SBOM) of the repository. This file is needed to run checks for third-party vulnerabilities and business approval according to Oracle’s GitHub policies. Please approve and merge this PR. If you have questions, please reach out to the Oracle GitHub team.
1 parent c991fa5 commit 08805fb

File tree

1 file changed

+16
-0
lines changed

1 file changed

+16
-0
lines changed

sbom_generation.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 0.1
2+
component: build
3+
timeoutInSeconds: 1000
4+
shell: bash
5+
6+
steps:
7+
- type: Command
8+
name: "Run Maven cycloneDX plugin command"
9+
command: |
10+
# For more details, visit https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/master/README.md
11+
mvn org.cyclonedx:cyclonedx-maven-plugin:2.7.5:makeAggregateBom -DincludeRuntimeScope=true -DincludeCompileScope=true -DincludeProvidedScope=false -DincludeSystemScope=false -DincludeTestScope=false -DoutputFormat=json -DoutputName=artifactSBOM -DschemaVersion=1.4
12+
mv target/artifactSBOM.json ./artifactSBOM.json
13+
outputArtifacts:
14+
- name: artifactSBOM
15+
type: BINARY
16+
location: ${OCI_PRIMARY_SOURCE_DIR}/artifactSBOM.json

0 commit comments

Comments
 (0)