github-actions-policy-consumer.yml

# Example only. Copy this file into a consumer repository under
# .github/workflows/ if useful. This repository does not run this file as a
# workflow.

name: Dependency policy review

on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  dependency-policy:
    runs-on: ubuntu-latest

    steps:
      - name: Check out consumer repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.x"

      - name: Download sbom-diff-and-risk release wheel
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p .tooling/sbom-diff-risk
          gh release download v1.0.0 \
            --repo stacknil/scientific-computing-toolkit \
            --pattern "sbom_diff_and_risk-1.0.0-py3-none-any.whl" \
            --dir .tooling/sbom-diff-risk

      - name: Install sbom-diff-risk
        run: |
          python -m pip install \
            .tooling/sbom-diff-risk/sbom_diff_and_risk-1.0.0-py3-none-any.whl

      - name: Run dependency policy
        id: compare
        shell: bash
        run: |
          mkdir -p outputs
          set +e
          sbom-diff-risk compare \
            --before path/to/before-sbom.json \
            --after path/to/after-sbom.json \
            --format auto \
            --policy path/to/policy.yml \
            --policy-json outputs/policy.json
          status=$?
          set -e
          echo "exit_code=$status" >> "$GITHUB_OUTPUT"

      - name: Upload policy JSON
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: dependency-policy-json
          path: outputs/policy.json
          if-no-files-found: error

      - name: Pass or fail based on local policy
        run: exit "${{ steps.compare.outputs.exit_code }}"