From a7773ba6e81cade2287dd2f8539dc4ad3620d5ac Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Wed, 28 Oct 2026 13:43:30 +0100 Subject: [PATCH] chore: add root syft config for the source SBOM The managed source SBOM failed sbom-with-licenses (592) and sbom-banned-licenses (1). Syft found no license for Go modules without a module cache, and it listed GitHub Actions, manifest files, CI tooling, the labs SDKs and test data, which are not shipped. Look up Go module licenses remotely, exclude .github, extras, labs and testdata, and do not list manifest files as components. The SBOM keeps the 472 Go modules of the root module, all with a license. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 82aee093-bc74-473c-a666-45f54c8814a1 --- .syft.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .syft.yaml diff --git a/.syft.yaml b/.syft.yaml new file mode 100644 index 000000000..ef4b6d963 --- /dev/null +++ b/.syft.yaml @@ -0,0 +1,22 @@ +# Root syft config, read automatically when syft runs from the repository root, +# as in the source SBOM that the sbom-generation workflow makes. +# +# The source SBOM lists what this repository ships. These paths are not part of +# it: CI workflows and their actions, CI tooling (extras), the experimental +# policy SDKs (labs), and test data. +exclude: + - ./.github/** + - ./extras/** + - ./labs/** + - "**/testdata/**" + +# Without a module cache, syft finds no license for Go modules. Get the +# licenses from the module proxy. +golang: + search-remote-licenses: true + +# Do not list the manifest files (go.mod and others) as components. They are +# not packages and have no license. +file: + metadata: + selection: none