contribfestgood first issuehelp wantedsecurity
Repository metrics
- Stars
- (73 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
We have SBOMs currently for Java and Go contribs. We could use them here as well. I recommend this utility: https://github.com/marketplace/actions/cyclonedx-node-js-generate-sbom (we're using the clyclonedx format elsewhere and it's popular).
Definition of done:
- SBOMs generated and attached to release artifact in GH, or otherwise made publicly available (for every release)
- runtime dependencies only included
- only includes dependencies of module in question (not of repo)
Relates to: https://github.com/open-feature/js-sdk/issues/649