Add SBOM pipeline

.github/actions/quill/steps/build/action.yml

@@ -14,6 +14,7 @@ runs:
       shell: bash
       run: |
         7z a -tzip -mx3 -mmt2 quill-artifact.zip dist
+
     - name: Upload artifact
       uses: actions/upload-artifact@v7
       with:

.github/workflows/publish.yml

@@ -12,17 +12,18 @@ on:
         type: boolean
         default: false
 
-permissions:
-  contents: read
-  id-token: write
+permissions: {}
 
 jobs:
-  publish:
-    runs-on: ubuntu-latest
-    environment: npmjs
+  build:
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Checkout Quill repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.version }}
 
@@ -37,10 +38,72 @@ jobs:
       - name: Pack
         run: |
           package_tgz=$(pnpm pack --json | jq -er 'if type=="array" then .[0].filename else .filename end')
-          echo "PACKAGE_TGZ=$package_tgz" >> "$GITHUB_ENV"
+          echo "PACKAGE_TGZ=$(realpath "$package_tgz")" >> "$GITHUB_ENV"
+
+      - name: Upload package
+        uses: actions/upload-artifact@v7
+        with:
+          name: package
+          path: ${{ env.PACKAGE_TGZ }}
+          if-no-files-found: error
+
+      - name: Set GitHub Packages auth
+        run: pnpm set //npm.pkg.github.com/:_authToken='${NODE_AUTH_TOKEN}'
+
+      - name: Build SBOM
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          cd tools/make-sbom
+          pnpm install --frozen-lockfile
+          pnpm dx-make-sbom ../../ dist/ "devextreme-quill($PACKAGE_TGZ)"
+
+      - name: Validate SBOM
+        uses: DevExpress/github-actions/validate-sbom@5034a6d5e0fd18fc2826ed20a5140f9c83b8994f
+        with:
+          input-file: tools/make-sbom/dist/devextreme-quill.cdx.json
+
+      - name: Publish SBOM to GitHub Packages
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version="$(pnpm pkg get version | tr -d '"')"
+          mkdir -p tools/make-sbom/pack && cp tools/make-sbom/dist/devextreme-quill.cdx.json tools/make-sbom/pack/
+          jq -n --arg v "$version" '{name:"@devexpress/devextreme-quill-sbom",version:$v,publishConfig:{registry:"https://npm.pkg.github.com"}}' > tools/make-sbom/pack/package.json
+          cd tools/make-sbom/pack
+          pnpm publish --no-git-checks
+
+  publish:
+    needs: build
+    runs-on: ubuntu-slim
+    environment: npmjs
+    permissions:
+      id-token: write  # Required for OIDC (Trusted Publishing)
+      contents: read
+
+    steps:
+      - name: Checkout Quill repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.version }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: '.node-version'
+
+      - name: Download package
+        uses: actions/download-artifact@v7
+        with:
+          name: package
+          path: package
 
       - name: Publish to NPM
-        run: pnpm publish "$PACKAGE_TGZ" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}
+        run: |
+          package_tgz=$(ls package/*.tgz)
+          pnpm publish "$package_tgz" --provenance --no-git-checks ${{ inputs['dry-run'] && '--dry-run' || '' }}
 
       - name: Setup NPM tags
         if: ${{ !inputs['dry-run'] }}

.gitignore

@@ -1,5 +1,6 @@
-/dist
-/node_modules
+dist
+tools/make-sbom/pack
+node_modules
 *.tgz
 *.zip
 /selenium

tools/make-sbom/.npmrc

@@ -0,0 +1 @@
+@devexpress:registry=https://npm.pkg.github.com

tools/make-sbom/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "devextreme-quill-sbom",
+  "version": "1.7.10",
+  "packageManager": "pnpm@11.7.0+sha512.19cc852c120c7125760f2443ee6be0ca5b40f9f50598de1a09a1f177503e010e57c23c77646e01e761de59bf874fb22a3398c33ab9691fc13eb946b6f0f4d620",
+  "private": true,
+  "devDependencies": {
+    "@devexpress/sbom-toolkit": "0.11.2"
+  },
+  "scripts": {
+    "make-sbom": "rm -rf dist/ && pnpm dx-make-sbom ../../ dist/ devextreme-quill"
+  }
+}