New workflow to show reachable components #3181
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This adds a new workflow to generate an SBOM with evidences using cdxgen.
Below are some links to a sample execution
Component Evidence
https://github.com/prabhu/dependency-track/actions/runs/6797742105/job/18480486493#step:4:22410
Call Stack Evidence
https://github.com/prabhu/dependency-track/actions/runs/6797742105/job/18480486493#step:4:24079
Reachable components
https://github.com/prabhu/dependency-track/actions/runs/6797742105/job/18480486493#step:4:24559
Addressed Issue
Publishing a comprehensive SBOM with a research profile would help security researchers and AppSec stays a step ahead with vulnerabilities. For instance, below are the top 3 libraries that dependency track users could prioritize to ensure their server instance doesn't get attacked when a vulnerability becomes public.
Additional Details
Related: DependencyTrack/frontend#644
Checklist