e-volv

Compliance playbook

SBOMGenerator

Generates a CycloneDX/SPDX software bill of materials on each release, diffs it against the previous release, and attaches it.

On a published release, generates a CycloneDX or SPDX software bill of materials covering every direct and transitive dependency with version, license, and source, diffs it against the previous release's SBOM, and attaches it to the release. The diff highlights packages added, removed, or version-changed, with any license change called out.

Identifier
sbom-generator
Version
1.0.0
Steps
3
Triggers
1
  • sbom
  • compliance
  • release
  • dependencies
  • security
  • automated

When it runs

Releaserelease.published
Settle delay
10s after the event

Only when all hold

  • release.draft not equals true
  • actor.username not contains [bot]

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    Release Publishedtrigger

    The event that starts the run.

  2. 02
    Clone Release Taggit.clone

    Shallow-clones the repository at the right ref.

  3. 03
    Generate and Attach SBOMagent.run

    One agent works the task with its toolkit.

The agent

SBOM Generator

Base type
Senior Developer
Temperature
0.2
Max iterations
40
Tools
5

Git provider · 2

  • update_releaseUpdate Release · write
  • create_or_update_fileCreate or Update File · write

Terminal · 1

  • run_terminal_cmdRun Terminal Command · write

Filesystem · 1

  • read_fileRead File · read

Status · 1

  • update_statusUpdate Status · write