feat(pipeline): analysis-based firmware SBOM from tramiton (#156)

2026-07-13 08:31:33 +00:00
parent 0ec5fd8295
commit eaaafc0621
5 changed files with 147 additions and 6 deletions
@@ -15,6 +15,9 @@ compliance-dast = { path = "../compliance-dast" }
 # available to the onboarding classifier. NOTE: CI must be able to fetch this
 # private repo (see the git-auth step in .gitea/workflows/ci.yml).
 tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
+# tramiton-repro's `libraries_from_inputs` turns a build plan's fetched inputs
+# into the SBOM-friendly library list (analysis-based firmware SBOM, no build).
+tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }