add dependency track analysis CI pipeline

kontent-ai · Sep 21, 2023 · f22430f · f22430f
1 parent a5269be
commit f22430f
Show file tree

Hide file tree

Showing 2 changed files with 6,326 additions and 0 deletions.
diff --git a/.github/workflows/dep-track.yml b/.github/workflows/dep-track.yml
@@ -0,0 +1,33 @@
+name: "Dependency track analysis"
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 18 * * 1'
+
+jobs:
+  Deptrack-build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+    - name: Setup .NET Core
+      uses: actions/setup-dotnet@v3
+      with:
+        dotnet-version: 7.0.x
+    - name: Install CycloneDX
+      run: dotnet tool install --global CycloneDX
+    - name: Create SBOM
+      run: dotnet CycloneDX .\Kontent.Ai.Delivery.sln -o ./cyclone
+    - name: Upload SBOM
+      uses: DependencyTrack/[email protected]
+      with:
+        serverHostname: ${{ secrets.DEPENDENCYTRACK_SERVER_URL }}
+        apiKey: ${{ secrets.DEPENDENCYTRACK_APIKEY }}
+        projectName: 'Delivery SDK .NET'
+        projectVersion: 'master'
+        bomFilename: "./cyclone/bom.xml"
+        autoCreate: true