From 9e2a2a6b376b86f0015bac9de6631fee7879554d Mon Sep 17 00:00:00 2001
From: mhg <marcel.haag@novatec-gmbh.de>
Date: Fri, 23 Feb 2024 11:13:23 +0100
Subject: [PATCH] feat: As a developer I want a pipeline to create a SBOM and
 analyse it with through the CSAF

---
 .github/workflows/c4po-ci.yml   |  3 +-
 .github/workflows/c4po-sbom.yml | 71 +++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/c4po-sbom.yml

diff --git a/.github/workflows/c4po-ci.yml b/.github/workflows/c4po-ci.yml
index aeb50ed..503bd1d 100644
--- a/.github/workflows/c4po-ci.yml
+++ b/.github/workflows/c4po-ci.yml
@@ -11,7 +11,8 @@ name: "CI: Clean Build C4PO"
 
 on:
   pull_request:
-    branches: [ "main" ]
+    # ToDo: Change back to main
+    branches: [ "test" ]
 
 
 env:
diff --git a/.github/workflows/c4po-sbom.yml b/.github/workflows/c4po-sbom.yml
new file mode 100644
index 0000000..788b96c
--- /dev/null
+++ b/.github/workflows/c4po-sbom.yml
@@ -0,0 +1,71 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# GitHub recommends pinning actions to a commit SHA.
+# To get a newer version, you will need to update the SHA.
+# You can also reference a tag or branch, but the action may change without warning.
+
+name: "Supply Chain Security C4PO SBOM Demo"
+
+on:
+  pull_request:
+    branches: [ "main" ]
+
+
+env:
+  REPORTING_PATH: security-c4po-reporting
+  CFG_PATH: security-c4po-cfg
+
+
+jobs:
+  reporting_job:
+          name: "Reportingservice SBOM Job"
+      
+          runs-on: ubuntu-latest
+          
+          steps:
+            - name: "Check out code"
+              uses: actions/checkout@v3
+
+            # Steps required for build process
+            - name: "Set up JDK 11"
+              uses: actions/setup-java@v3
+              with:
+                java-version: '11'
+                distribution: 'temurin'
+      
+            - name: "Setup Gradle"
+              uses: gradle/gradle-build-action@v2
+              with:
+                gradle-version: 6.5
+      
+            - name: "Execute Gradle build"
+              run: |
+                cd $REPORTING_PATH
+                ./gradlew clean build
+
+            # Steps required for SBOM creation
+            - name: "Generate Reporting SBOM"
+              id: reporting_sbom
+              uses: anchore/sbom-action@v0
+              with:
+                path: './security-c4po-reporting'
+                format: cyclonedx-json
+                output-file: "${{ github.event.repository.name }}-reporting-sbom.cyclonedx.json"
+                upload-artifact: true
+
+            # ToDo: Push SBOM to self-hosted Dependency Track instance
+
+            # Working version to generate & analyse SBOMs
+            # Might be not good for company data
+            - name: "Generate SBOM"
+              id: sbom_generation
+              uses: codenotary/sbom.sh-create@main
+              with:
+                scan_type: 'grypefs'
+                target: './security-c4po-reporting' # . -> Assuming you want to scan the entire repository
+
+            - name: Output SBOM URL
+              run: echo "The Reportingservice SBOM can be found at $SBOM_SHARE_URL"