ci: setup yaml linting of SBOM Catalog

.github/requirements.txt

@@ -0,0 +1 @@
+yamale==5.2.1

.github/workflows/build-pull-request.yml

@@ -16,6 +16,21 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 'lts/*'
+
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+        with:
+          python-version: '3.10'
+          cache: 'pip' # caching pip dependencies
+      - run: pip install -r .github/requirements.txt
+
+      - name: Lint Catalog Data
+        run: yamllint -d relaxed SBOM-Catalog
+
+      - name: Schema Check Catalog Data
+        run: yamale -s SBOM-Catalog/schemas/data.yaml SBOM-Catalog/public/data.yaml
+
+      - name: Schema Check Catalog Filters
+        run: yamale -s SBOM-Catalog/schemas/filters.yaml SBOM-Catalog/public/filters.yaml
 
       - name: Install dependencies
         run: cd SBOM-Catalog && npm install

SBOM-Catalog/public/data.yaml

@@ -1,3 +1,4 @@
+---
 - Name: Syft
   Link: https://github.com/anchore/syft
   Publisher: Anchore
@@ -589,9 +590,9 @@
   Abilities:
     - Consume
     - Compare
-  Type: 
+  Type:
     - Source
     - Build
     - Analyzed
   Language:
-    - Generic
+    - Generic

SBOM-Catalog/public/filters.yaml

@@ -1,18 +1,19 @@
+---
 - name: Standards
   enabled: true
   description: Filter to distinguish between SBOM standards like SPDX and CycloneDx
 
 - name: License
   enabled: false
   description: Filter to distinguish between different license types like OpenSource or Proprietary
 
 - name: Abilities
   enabled: true
   description: Filter to distinguish between different abilities like SBOM creation, conversion or consumption
 
 - name: Type
   enabled: false
   description: Filter to distinguish between different phases where SBOMs are created like sources, build or analysed
 
 - name: Publisher
   enabled: false
@@ -24,4 +25,4 @@
 
 - name: Language
   enabled: false
-  description: Filter to distinguish between different programming languages, build tools or operating systems
+  description: Filter to distinguish between different programming languages, build tools or operating systems

SBOM-Catalog/schemas/data.yaml

@@ -0,0 +1,13 @@
+# Yamale schema file for SBOM-Catalog/public/data.yaml
+
+list(include('data_item'))
+---
+data_item:
+  Name: str()
+  Link: str()
+  Publisher: str()
+  License: enum('OpenSource', 'Proprietary')
+  Standards: list(enum('CycloneDX', 'SPDX', 'SWID'))
+  Abilities: list(enum('Compare', 'Consume', 'Convert', 'Edit', 'Generate', 'Merge', 'Validate'))
+  Type: subset(enum('Design', 'Source', 'Build', 'Analyzed', 'Deployed', 'Runtime', 'Container'), allow_empty=True)
+  Language: subset(str(), allow_empty=True)

SBOM-Catalog/schemas/filters.yaml

@@ -0,0 +1,7 @@
+list(include('filter_item'))
+
+---
+filter_item:
+  name: str()
+  enabled: bool()
+  description: str()