Implementing Software Bill of Materials (SBOM) in Enterprise CI/CD Pipelines

# macOS/Linux
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
syft version

# CycloneDX JSON format (recommended for security use cases)
syft myregistry.azurecr.io/myapp:v1.2.3 -o cyclonedx-json > sbom.json

# SPDX format (for license compliance)
syft myregistry.azurecr.io/myapp:v1.2.3 -o spdx-json > sbom-spdx.json

# View in human-readable table
syft myregistry.azurecr.io/myapp:v1.2.3 -o table

name: Build and Generate SBOM

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Container Image
        run: docker build -t ${{ env.IMAGE_NAME }}:${{ github.sha }} .

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.cyclonedx.json

      - name: Upload SBOM as Artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.cyclonedx.json

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Basic scan
grype sbom:sbom.cyclonedx.json

# Fail on high/critical vulnerabilities (for CI/CD gates)
grype sbom:sbom.cyclonedx.json --fail-on high

# Output as JSON for further processing
grype sbom:sbom.cyclonedx.json -o json > vulnerabilities.json

- name: Scan SBOM for Vulnerabilities
  run: |
    grype sbom:sbom.cyclonedx.json --fail-on critical
  continue-on-error: false

# macOS
brew install cosign

# Linux
curl -O -L https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
chmod +x cosign-linux-amd64
mv cosign-linux-amd64 /usr/local/bin/cosign

# Sign the container image (keyless via OIDC)
cosign sign $IMAGE_NAME:$TAG

# Attach SBOM to the image
cosign attach sbom --sbom sbom.cyclonedx.json $IMAGE_NAME:$TAG

# Create and sign an SBOM attestation
cosign attest --predicate sbom.cyclonedx.json --type cyclonedx $IMAGE_NAME:$TAG

# Generate key pair
cosign generate-key-pair

# Sign with private key
cosign sign --key cosign.key $IMAGE_NAME:$TAG

# Verify with public key
cosign verify --key cosign.pub $IMAGE_NAME:$TAG

trigger:
  branches:
    include:
      - main
      - release/*

variables:
  imageName: 'myregistry.azurecr.io/myapp'
  tag: '$(Build.BuildId)'

stages:
  - stage: Build
    displayName: 'Build and Scan'
    jobs:
      - job: BuildJob
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - task: Docker@2
            displayName: 'Build Container Image'
            inputs:
              containerRegistry: 'AzureContainerRegistry'
              repository: 'myapp'
              command: 'build'
              Dockerfile: '**/Dockerfile'
              tags: '$(tag)'

          - script: |
              curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
              syft $(imageName):$(tag) -o cyclonedx-json > $(Build.ArtifactStagingDirectory)/sbom.json
            displayName: 'Generate SBOM'

          - script: |
              curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
              grype sbom:$(Build.ArtifactStagingDirectory)/sbom.json --fail-on critical
            displayName: 'Vulnerability Scan'

          - script: |
              curl -O -L https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64
              chmod +x cosign-linux-amd64
              ./cosign-linux-amd64 sign --key $(COSIGN_PRIVATE_KEY) $(imageName):$(tag)
              ./cosign-linux-amd64 attest --key $(COSIGN_PRIVATE_KEY) --predicate $(Build.ArtifactStagingDirectory)/sbom.json --type cyclonedx $(imageName):$(tag)
            displayName: 'Sign Image and Attest SBOM'
            env:
              COSIGN_PRIVATE_KEY: $(CosignPrivateKey)
              COSIGN_PASSWORD: $(CosignPassword)

          - task: Docker@2
            displayName: 'Push to Registry'
            inputs:
              containerRegistry: 'AzureContainerRegistry'
              repository: 'myapp'
              command: 'push'
              tags: '$(tag)'

          - publish: $(Build.ArtifactStagingDirectory)/sbom.json
            artifact: sbom
            displayName: 'Publish SBOM Artifact'

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-image-signatures
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "myregistry.azurecr.io/*"
          attestors:
            - count: 1
              entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
                      -----END PUBLIC KEY-----

# Upload SBOM to Dependency-Track via API
curl -X POST "https://dependencytrack.example.com/api/v1/bom" \
  -H "X-Api-Key: $DT_API_KEY" \
  -H "Content-Type: application/vnd.cyclonedx+json" \
  -d @sbom.cyclonedx.json