Add CycloneDX SBOM generation for staging images

.github/workflows/run-ci-cd.yaml

@@ -552,6 +552,39 @@ jobs:
         run: |
           make security-scan-backend-image BACKEND_IMAGE_NAME=owasp/nest:backend-staging
           make security-scan-frontend-image FRONTEND_IMAGE_NAME=owasp/nest:frontend-staging
+
+      - name: Generate SBOM for backend image
+        continue-on-error: true
+        run: |
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PWD:/work" \
+            -v ./.trivy-cache:/root/.cache/trivy \
+            aquasec/trivy:0.69.1 image \
+            --format cyclonedx \
+            --output /work/backend-sbom.cdx.json \
+            owasp/nest:backend-staging
+
+      - name: Generate SBOM for frontend image
+        continue-on-error: true
+        run: |
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -v "$PWD:/work" \
+            -v ./.trivy-cache:/root/.cache/trivy \
+            aquasec/trivy:0.69.1 image \
+            --format cyclonedx \
+            --output /work/frontend-sbom.cdx.json \
+            owasp/nest:frontend-staging
+
+      - name: Upload SBOM artifacts
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: staging-sboms
+          path: |
+            backend-sbom.cdx.json
+            frontend-sbom.cdx.json
     timeout-minutes: 5
 
   deploy-staging-nest:

cspell/custom-dict.txt

@@ -71,6 +71,7 @@ bangbang
 boardofdirectors
 bsky
 carryforward
+cdx
 certbot
 collectstatic
 coraza
@@ -79,6 +80,7 @@ csrfguard
 csrfprotector
 csrftoken
 cva
+cyclonedx
 defectdojo
 demojize
 dismissable
@@ -164,6 +166,7 @@ rsc
 saft
 sakanashi
 samm
+sbom
 schemathesis
 semgrep
 seo