diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index b02211d80..20528e67b 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -1,20 +1,28 @@ name: Dependency Scan -on: pull_request +on: + pull_request: + push: + branches: + - main jobs: - dependency-scan: + generate-nodejs-sbom: runs-on: ubuntu-latest steps: - - name: Setup Go - uses: actions/setup-go@v5 - with: - go-version: 'stable' + - uses: actions/checkout@v4 - name: Generate SBOM uses: launchdarkly/gh-actions/actions/dependency-scan/generate-sbom@main with: - types: 'go,nodejs' + types: 'nodejs' + evaluate-policy: + runs-on: ubuntu-latest + needs: + - generate-nodejs-sbom + steps: - name: Evaluate SBOM Policy uses: launchdarkly/gh-actions/actions/dependency-scan/evaluate-policy@main + with: + artifacts-pattern: bom-*