CI Pull Request on Main Branch

add custom sbom generation #365

Sign in to view logs

Triggered via pull request July 31, 2026 00:14

mwrock

synchronize #2020

sbom

Status Success

Total duration 2m 26s

Artifacts 6

ci-main-pull-request-stub.yml

on: pull_request

call-ci-main-pr-check-pipeline / Checkout repository

Echo stub version

call-ci-main-pr-check-pipeline / Pre-compilation checks

Generate Habitat Package + Cargo + npm SBOM and Import to BlackDuck

call-ci-main-pr-check-pipeline / Build/compilation and unit tests (CI)

call-ci-main-pr-check-pipeline / ... / Export SBOM from GitHub Dependency Graph API

call-ci-main-pr-check-pipeline / ... / Blackduck SCA Scan (PURPLE)

call-ci-main-pr-check-pipeline / ... / Generate MSFT SBOM

call-ci-main-pr-check-pipeline / ... / license_scout

call-ci-main-pr-check-pipeline / ... / Build and upload Docker image

call-ci-main-pr-check-pipeline / ... / Complexity and SLOC generation

call-ci-main-pr-check-pipeline / Language-specific pre-compilation steps and linting

call-ci-main-pr-check-pipeline / Language-agnostic pre-compilation steps

call-ci-main-pr-check-pipeline / ... / Trufflehog

call-ci-main-pr-check-pipeline / Grype scan

call-ci-main-pr-check-pipeline / ... / BlackDuck Polaris SAST scan

call-ci-main-pr-check-pipeline / ... / Grype scan (Linux)

call-ci-main-pr-check-pipeline / ... / Grype scan (MacOS)

call-ci-main-pr-check-pipeline / ... / Grype scan (Windows)

call-ci-main-pr-check-pipeline / Creating packaged binaries

call-ci-main-pr-check-pipeline / Detect SBOM version for application

Matrix: call-ci-main-pr-check-pipeline / Unit tests

call-ci-main-pr-check-pipeline / ... / irfan

call-ci-main-pr-check-pipeline / ... / Grype vulnerability scan

call-ci-main-pr-check-pipeline / ... / Wiz CLI container image scan

call-ci-main-pr-check-pipeline / Creating Habitat packages

call-ci-main-pr-check-pipeline / Publishing Habitat packages to Builder

call-ci-main-pr-check-pipeline / Publishing packages

call-ci-main-pr-check-pipeline / Grype scan of Habitat packages

call-ci-main-pr-check-pipeline / Grype scan of Habitat packages (Windows)

Annotations

3 warnings

call-ci-main-pr-check-pipeline / Generating SBOM / Export SBOM from GitHub Dependency Graph API

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

call-ci-main-pr-check-pipeline / Source code complexity checks / Complexity and SLOC generation

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Generate Habitat Package + Cargo + npm SBOM and Import to BlackDuck

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime

Name	Size	Digest
cyclonedx-sbom-habitat	165 KB	`sha256:9f89f0973abfe375a75cb7797c4bce499c964cd1219aaefbc496e2cffc7566c1`
habitat-sh-builder-2020-merge-20251014-20260731001511-GitHub-sbom.csv	29.9 KB	`sha256:0c6e650810d74565c964ee5c08a73a4a6ab0b8ff9a248edd061c1aa79593b663`
habitat-sh-builder-2020-merge-20260731001527-scc-complexity.html	15.5 KB	`sha256:91d72fd64746caa34d4881d5265bb904296108a7d8baf548df7d23324815ba0b`
habitat-sh-builder-2020-merge-20260731001527-scc-complexity.json	19.5 KB	`sha256:1944cad1cace72e0b1ecbf3950540cb6c2058b2545a7e10afd415f28c50bfc45`
habitat-sh-builder-2020-merge-20260731001527-scc-complexity.txt	1.05 KB	`sha256:1cb8d104e7e60ff9d985e5c30b76e4c310577b0742a67685ce5eccdbe2e8b53d`
habitat-sh-builder-20260731001511-GitHub-sbom.json	82 KB	`sha256:287d2f1c4454f249f67d51316fee9604483e7d48673cda8c537a4f517c21b80c`