Added draft sbom_generation file

sbom_generation.yaml

@@ -0,0 +1,48 @@
+# Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
+
+# This OCI DevOps build specification file [1] generates a Software Bill of Materials (SBOM) of the repository.
+# The file is needed to run checks for third-party vulnerabilities and business approval according to Oracle’s GitHub policies.
+# [1] https://docs.oracle.com/en-us/iaas/Content/devops/using/build_specs.htm
+
+version: 0.1
+component: build
+timeoutInSeconds: 1000
+shell: bash
+
+steps:
+  - type: Command
+    name: "Installing syft"
+    command: |
+      curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b ./
+  - type: Command
+    name: "Create SBOM for the nbcode (java project)  using syft "
+    command: |
+      export SYFT_FORMAT_PRETTY=true
+      chmod +x syft
+      ./syft ./nbcode -o [email protected]=./nbcode/nbcodeSBOM.json --source-name nbcode
+  - type: Command
+    name: "Install dependencies & cyclonedx-node-npm package"
+    command: |
+      cd vscode
+      npm install && npm install --save-dev @cyclonedx/cyclonedx-npm
+  - type: Command
+    name: "Run cyclonedx-node-npm package"
+    command: |
+      cd vscode
+      # For more details, visit https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/README.md
+      npx @cyclonedx/cyclonedx-npm --omit dev --output-format JSON --output-file vscodeSBOM.json --spec-version 1.4
+  - type: Command
+    name: "Download CycloneDx-cli executable and install dependencies"
+    command: |
+      wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.24.2/cyclonedx-linux-x64
+      yum install -y libicu
+  - type: Command
+    name: "Merge multiple SBOMs using CycloneDX-cli"
+    command: |
+      # For more details, visit https://github.com/CycloneDX/cyclonedx-cli/blob/main/README.md
+      chmod +x cyclonedx-linux-x64
+      ./cyclonedx-linux-x64 merge --input-files ./vscode/vscodeSBOM.json  ./nbcode/nbcodeSBOM.json   --output-file artifactSBOM.json
+outputArtifacts:
+  - name: artifactSBOM
+    type: BINARY
+    location: ${OCI_PRIMARY_SOURCE_DIR}/artifactSBOM.json