SBOM composite action workflow

.github/actions/sbom-convert/action.yml

@@ -0,0 +1,13 @@
+name: Action for converting CycloneDX SBOM files to SPDX format
+runs:
+  using: "composite"
+  steps:
+    - name: Install CycloneDX
+      run: |
+        wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.2/cyclonedx-linux-x64
+        chmod a+x cyclonedx-linux-x64
+      shell: bash
+    - name: Convert SBOM
+      run: |
+        ./cyclonedx-linux-x64 convert --input-format json --output-format spdxjson --input-file cyclonedx-sbom.json --output-file spdx.json
+      shell: bash

.github/workflows/publish.yml

@@ -22,6 +22,12 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install setuptools wheel twine
+    - name: Generate SBOM
+      run: |
+        pip install cyclonedx-bom
+        cyclonedx-py --e --format json -o cyclonedx-sbom.json
+    - name: Convert SBOM
+      uses: duosecurity/duo_client_python/.github/actions/sbom-convert@master
     - name: Build and publish
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}

MANIFEST.in

@@ -7,3 +7,4 @@ include README.md
 include duo_client/ca_certs.pem
 include requirements.txt
 include requirements-dev.txt
+include spdx.json