ci(security): add secret scan and SBOM

2026-08-30 22:22:19 +02:00
parent 9ad812e9ba
commit 8c3822c440
9 changed files with 330 additions and 6 deletions
@@ -58,7 +58,14 @@ jobs:
      - name: Test repository safety scripts
        # Standard-library only and plan-only: this validates the synthetic benchmark harness
        # without contacting Ollama, pulling a model, or requiring package installation.
-        run: python3 scripts/test-ollama-evaluation.py
+        run: |
+          python3 scripts/test-ollama-evaluation.py
+          python3 scripts/test-supply-chain.py
+
+      - name: Scan tracked files and generate dependency SBOM
+        run: |
+          python3 scripts/supply-chain.py scan-secrets
+          python3 scripts/supply-chain.py generate-sbom --output .artifacts/jobjakt.cdx.json

      - name: Test document parser boundary
        working-directory: tools/summarizer