Add SBOM pipeline

.github/workflows/publish.yml

@@ -10,13 +10,13 @@ on:
 
 permissions:
   contents: read
+  packages: write
   id-token: write
 
 jobs:
-  publish:
-    name: Build & Publish NPM packages
+  build:
+    name: Build NPM packages
     runs-on: ubuntu-latest
-    environment: npmjs
 
     steps:
       - name: Get sources
@@ -30,6 +30,9 @@ jobs:
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            tools/make-sbom/pnpm-lock.yaml
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install dependencies
@@ -46,11 +49,91 @@ jobs:
           package_cli_tgz="$(pnpm --filter devextreme-cli pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
           package_schematics_tgz="$(pnpm --filter devextreme-schematics pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')"
 
-          echo "PACKAGE_CLI_TGZ=$package_cli_tgz" >> "$GITHUB_ENV"
-          echo "PACKAGE_SCHEMATICS_TGZ=$package_schematics_tgz" >> "$GITHUB_ENV"
+          echo "PACKAGE_CLI_TGZ=$(realpath "$package_cli_tgz")" >> "$GITHUB_ENV"
+          echo "PACKAGE_SCHEMATICS_TGZ=$(realpath "$package_schematics_tgz")" >> "$GITHUB_ENV"
+
+      - name: Upload devextreme-cli package
+        uses: actions/upload-artifact@v7
+        with:
+          name: package-cli
+          path: ${{ env.PACKAGE_CLI_TGZ }}
+          if-no-files-found: error
+
+      - name: Upload devextreme-schematics package
+        uses: actions/upload-artifact@v7
+        with:
+          name: package-schematics
+          path: ${{ env.PACKAGE_SCHEMATICS_TGZ }}
+          if-no-files-found: error
+
+      - name: Build SBOMs
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pnpm set //npm.pkg.github.com/:_authToken="$NODE_AUTH_TOKEN"
+          cd tools/make-sbom && pnpm install --frozen-lockfile && pnpm dx-make-sbom ../../ dist/ "devextreme-cli($PACKAGE_CLI_TGZ),devextreme-schematics($PACKAGE_SCHEMATICS_TGZ)"
+
+      - name: Validate SBOMs
+        uses: DevExpress/github-actions/validate-sbom@5034a6d5e0fd18fc2826ed20a5140f9c83b8994f
+        with:
+          input-format: json
+          input-files: |
+            tools/make-sbom/dist/devextreme-cli.cdx.json
+            tools/make-sbom/dist/devextreme-schematics.cdx.json
+
+      - name: Publish devextreme-cli SBOM to npm.pkg.github.com
+        run: |
+          version="$(cd packages/devextreme-cli && pnpm pkg get version | tr -d '"')"
+          mkdir -p tools/make-sbom/pack/devextreme-cli && cp tools/make-sbom/dist/devextreme-cli.cdx.json tools/make-sbom/pack/devextreme-cli/
+          jq -n --arg v "$version" '{name:"@devexpress/devextreme-cli-sbom",version:$v}' > tools/make-sbom/pack/devextreme-cli/package.json
+          cd tools/make-sbom/pack/devextreme-cli
+          pnpm publish --registry https://npm.pkg.github.com --no-git-checks
+
+      - name: Publish devextreme-schematics SBOM to npm.pkg.github.com
+        run: |
+          version="$(cd packages/devextreme-schematics && pnpm pkg get version | tr -d '"')"
+          mkdir -p tools/make-sbom/pack/devextreme-schematics && cp tools/make-sbom/dist/devextreme-schematics.cdx.json tools/make-sbom/pack/devextreme-schematics/
+          jq -n --arg v "$version" '{name:"@devexpress/devextreme-schematics-sbom",version:$v}' > tools/make-sbom/pack/devextreme-schematics/package.json
+          cd tools/make-sbom/pack/devextreme-schematics
+          pnpm publish --registry https://npm.pkg.github.com --no-git-checks
+
+  publish:
+    name: Publish NPM packages
+    needs: build
+    runs-on: ubuntu-latest
+    environment: npmjs
+
+    steps:
+      - name: Get sources
+        uses: actions/checkout@v6
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Use Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: '.node-version'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Download devextreme-cli package
+        uses: actions/download-artifact@v7
+        with:
+          name: package-cli
+          path: package-cli
+
+      - name: Download devextreme-schematics package
+        uses: actions/download-artifact@v7
+        with:
+          name: package-schematics
+          path: package-schematics
 
       - name: Publish devextreme-cli
-        run: pnpm publish "$PACKAGE_CLI_TGZ" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}
+        run: |
+          package_cli_tgz=$(ls package-cli/*.tgz)
+          pnpm publish "$package_cli_tgz" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}
 
       - name: Publish devextreme-schematics
-        run: pnpm publish "$PACKAGE_SCHEMATICS_TGZ" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}
+        run: |
+          package_schematics_tgz=$(ls package-schematics/*.tgz)
+          pnpm publish "$package_schematics_tgz" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}

.gitignore

@@ -10,6 +10,8 @@
 **/pnpm-debug.log*
 **/yarn-error.log*
 *.tgz
+dist
+tools/make-sbom/pack
 packages/devextreme-cli/testing/sandbox/
 packages/devextreme-cli/testing/__tests__/__diff_snapshots__/
 

tools/make-sbom/.npmrc

@@ -0,0 +1 @@
+@devexpress:registry=https://npm.pkg.github.com

tools/make-sbom/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "devextreme-cli-monorepo-sbom",
+  "version": "1.16.0",
+  "packageManager": "pnpm@11.8.0+sha512.c1f5e7c4cb241c8f174b743851d82f42b802324afc8b0f116b96adb15aa06664948dde36960a3ba1079ba5b4b29dd0140135b94b5b5f5263592249d68e555f26",
+  "private": true,
+  "devDependencies": {
+    "@devexpress/sbom-toolkit": "0.11.2"
+  },
+  "scripts": {
+    "make-sbom": "rm -rf dist/ && pnpm dx-make-sbom ../../ dist/ devextreme-cli,devextreme-schematics"
+  }
+}