Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying GitHub Actions Cookbook
  • Table Of Contents Toc
  • Feedback & Rating feedback
GitHub Actions Cookbook

GitHub Actions Cookbook

By : Michael Kaufmann
4.8 (5)
close
close
GitHub Actions Cookbook

GitHub Actions Cookbook

4.8 (5)
By: Michael Kaufmann

Overview of this book

Say goodbye to tedious tasks! GitHub Actions is a powerful workflow engine that automates everything in the GitHub ecosystem, letting you focus on what matters most. This book explains the GitHub Actions workflow syntax, the different kinds of actions, and how GitHub-hosted and self-hosted workflow runners work. You’ll get tips on how to author and debug GitHub Actions and workflows with Visual Studio Code (VS Code), run them locally, and leverage the power of GitHub Copilot. The book uses hands-on examples to walk you through real-world use cases that will help you automate the entire release process. You’ll cover everything, from automating the generation of release notes to building and testing your software and deploying securely to Azure, Amazon Web Services (AWS), or Google Cloud using OpenID Connect (OIDC), secrets, variables, environments, and approval checks. The book goes beyond CI/CD by demonstrating recipes to execute IssueOps and automate other repetitive tasks using the GitHub CLI, GitHub APIs and SDKs, and GitHub Token. You’ll learn how to build your own actions and reusable workflows to share building blocks with the community or within your organization. By the end of this GitHub book, you'll have gained the skills you need to automate tasks and work with remarkable efficiency and agility.
Table of Contents (10 chapters)
close
close
8
Index
In Progress | 0 / 2 sections completed | 0%

Generating and using SBOMs

An SBOM (see https://www.cisa.gov/sbom) declares the nested inventory of components that make up the software. The United States government is required to obtain an SBOM for any product they purchase by the Cyber Supply Chain Management and Transparency Act of 2014.

You can manually export an SBOM in GitHub under Insights | Dependency graph | Export SBOM (see Figure 6.19):

Figure 6.19 – Manually exporting an SBOM in a repository

Figure 6.19 – Manually exporting an SBOM in a repository

The SBOM is a JSON file following the Software Package Data Exchange (SPDX) standard.

In this recipe, we will automate the process of generating an SBOM from the current dependencies of the repository and attach it to the release as an additional attachment.

Getting ready

Switch to a new branch:

$ git switch -c upload-sbom

How to do it…

  1. Edit the .github/workflows/release.yml file. Modify the permission for the publish job to allow write access to permissions:
    jobs...

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech

Create a Note

Modal Close icon
You need to login to use this feature.
notes
bookmark search playlist download font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Delete Note

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete

Confirmation

Modal Close icon
claim successful

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY