feat: add SBOM CI component#4
Open
Grayknife wants to merge 2 commits into
Open
Conversation
OrbisK
approved these changes
Jul 7, 2026
There was a problem hiding this comment.
Pull request overview
Adds an SBOM-related CI component include to the Django cookiecutter template’s GitLab CI configuration so generated projects can run SBOM/dependency-audit jobs as part of their pipeline.
Changes:
- Add a new
include:componententry forsecurity/dependency-audit/sbom@0.3.6in the template.gitlab-ci.yml.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…uctions for templates
Comment on lines
16
to
20
| ```shell | ||
| cookiecutter https://github.com/singularit-de/cc-python.git --directory django | ||
| # or | ||
| uvx cookiecutter https://github.com/singularit-de/cc-python.git --directory django | ||
| ``` |
Comment on lines
27
to
+29
| ## Why we are using templates | ||
|
|
||
| ## Contribute to this repository | ||
| ## Testing template updates locally |
| pre-commit install | ||
| ``` | ||
|
|
||
| ## Gitlab CI/CD |
|
|
||
| ### Dependency Track | ||
|
|
||
| The uv.lock file is used to track vulnerabilities in dependencies. |
|
|
||
| #### Lint | ||
|
|
||
| In the lint stage we are running `pre-commit'` that checks for code formatting and linting issues. |
|
|
||
| In the lint stage we are running `pre-commit'` that checks for code formatting and linting issues. | ||
|
|
||
| When? Each push to a protected branch or a branch that has an open pull request to a protected branch. |
| 2. `deploy-check` - runs the django deployment check for security issues | ||
| 3. `sbom:uv:prod` - generates a Software Bill of Materials (SBOM) for the Dependency Track Dashboard. There is a separate .post stage where the SBOM is uploaded to the Dependency Track Dashboard. | ||
|
|
||
| When? Each push to a protected branch or a branch that has an open pull request to a protected branch. |
Comment on lines
+121
to
+122
| When? Each push to a protected branch or a branch that has an open pull request to a protected branch. | ||
| staging server. |
OrbisK
suggested changes
Jul 8, 2026
| ### Dependency Track | ||
|
|
||
| The uv.lock file is used to track vulnerabilities in dependencies. | ||
| Every push to a protected branch or a created tag will trigger an update of the Dependency Track Dashboard. |
Member
There was a problem hiding this comment.
das ist theoretisch nicht korrekt. Die default rule, dass die jobs laufen ist:
($CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_TAG) && $CI_PIPELINE_SOURCE != "schedule"
in kurz: Wenn du auf den default branch pushst, oder einen tag (und nicht bei gescheduled pipelines). Das kann aber alles per input konifguriert werden: https://singular-code.de/explore/catalog/singularit/ci-components/security/dependency-audit?tab=components
|
|
||
| 1. `django-test` - runs the django unit tests | ||
| 2. `deploy-check` - runs the django deployment check for security issues | ||
| 3. `sbom:uv:prod` - generates a Software Bill of Materials (SBOM) for the Dependency Track Dashboard. There is a separate .post stage where the SBOM is uploaded to the Dependency Track Dashboard. |
Member
There was a problem hiding this comment.
ist glaube ich nicht wichtig zu erwähnen, dass die auch da ist. Weil die ja sehr abstract ist.
Comment on lines
+121
to
+122
| When? Each push to a protected branch or a branch that has an open pull request to a protected branch. | ||
| staging server. |
Member
There was a problem hiding this comment.
meinst du hier staging und review app oder wieso auch wenn man vom mr aus kommt?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.