ci: attach SBOM (SPDX + CycloneDX) to every release #51
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) 2026 Santander Group | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # License compliance. The core install of llm_bridge has NO required runtime | |
| # dependencies (vendor SDKs are optional extras). This workflow verifies that: | |
| # 1. every Python source file declares an SPDX-License-Identifier, and | |
| # 2. the required `dependencies` array stays empty (core must remain | |
| # stdlib-only; SDKs live under [project.optional-dependencies]). | |
| name: License check | |
| on: | |
| push: | |
| branches: [main, development] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| no-required-deps: | |
| name: Assert core has no required dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Fail if a required runtime dependency is introduced | |
| run: | | |
| set -euo pipefail | |
| if [ -f requirements.txt ]; then | |
| echo "FAIL: requirements.txt introduces required runtime deps." | |
| echo "Vendor SDKs must stay under [project.optional-dependencies]." | |
| exit 1 | |
| fi | |
| deps=$(python scripts/check_no_required_deps.py) | |
| if [ -n "$deps" ]; then | |
| echo "FAIL: [project].dependencies must be empty, found - $deps" | |
| echo "Move vendor SDKs to [project.optional-dependencies]." | |
| exit 1 | |
| fi | |
| echo "OK: core has no required runtime dependencies." | |
| spdx-headers: | |
| name: SPDX headers | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Verify every Python file declares SPDX-License-Identifier | |
| run: | | |
| missing=0 | |
| while IFS= read -r f; do | |
| if ! head -n 5 "$f" | grep -q "SPDX-License-Identifier:"; then | |
| echo "MISSING SPDX header: $f" | |
| missing=$((missing + 1)) | |
| fi | |
| done < <(find src tests examples -type f -name "*.py") | |
| if [ "$missing" -gt 0 ]; then | |
| echo "Found $missing files without SPDX header." | |
| exit 1 | |
| fi | |
| echo "OK: all Python files have SPDX headers." |