[formulation] Capture workflow steps

[prabhu]

It will be super cool to convert CI workflows such as .github/workflows and gitlab pipeline files into workflow steps. This would immensely help with troubleshooting as well, since the SBOM would list the OS commands and libraries needed to successfully build applications.

https://cyclonedx.org/docs/1.6/json/#formulation_items_workflows_items_steps

[prabhu]

Candidate for "Winter of Code"

I am currently working on this.

[prabhu]

@satwiksps how are you planning to implement this? By enhancing parseGitHubWorkflowData?

Yes, I plan to enhance parseGitHubWorkflowData. I will add logic to extract workflow steps from .github/workflows/*.yml files.
I am extremely sorry for delay in creating the PR. I am working in this issue.

Implementation Plan:

• Parse Workflow Files:
  Enhance parseGitHubWorkflowData to read and parse YAML files for jobs, steps, and commands.
• Map Data to CycloneDX Schema:
  Convert extracted steps into the CycloneDX JSON format for workflow steps.
• Support Key Attributes:
  Capture attributes such as step name, run commands, and uses references.
• Handle Edge Cases:
  Include error handling for missing or invalid workflow definitions.

Testing and Validation:

• Create unit tests for different workflow file structures.
• Ensure the output conforms to the CycloneDX schema.

[prabhu]

@satwiksps, touching base to see how you are getting along. Please feel free to pass it back to me in case you would like to look into something else.

I sincerely apologize for not being able to work on this issue as I initially intended. Due to unforeseen commitments, I couldn't dedicate the necessary time to contribute to open source effectively. I truly respect your patience and forgiveness. I request you to reassign this issue to someone else. I hope to contribute to in the future when I can commit more time.
Being a begginer this experience has taught me an important lesson—to only express interest in an issue after making some progress and being confident that I can resolve it, rather than immediately requesting an assignment. I will be more mindful of this in the future.

Thank you for your understanding 🙏