Comfy-Org / Comfy-Org/ComfyUI_frontend
Add SBOM (Software Bill of Materials) generation to CI
Open
area:CI/CD
audit:supply-chain
code-audit
effort:small
priority:nice-to-have
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 699
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 490
Description
## Recommendation
### 📋 Add SBOM Generation
No SBOM generation workflow found. SBOMs are increasingly required for compliance and supply chain transparency.
## How to Fix
Add a workflow using `anchore/sbom-action` or `CycloneDX/gh-node-module-generatebom`:
```yaml
- uses: anchore/sbom-action@v0
with:
artifact-name: sbom.spdx.json
```
---
**Category:** Supply Chain | **Priority:** Nice-to-have | **Effort:** Small
Part of #11022
_Filed by repo-audit skill_
┆Issue is synchronized with this [Notion page](https://www.notion.so/Issue-11076-Add-SBOM-Software-Bill-of-Materials-generation-to-CI-33e6d73d365081dea2fef2eac33ed7ba) by [Unito](https://www.unito.io)
Contributor guide
Assessment
This issue has not been assessed yet.