.NET SBOM Generation Guide: C# Software Bills of Materials

# Install the tool
dotnet tool install --global CycloneDX

# Generate from a solution
dotnet-CycloneDX MySolution.sln -o bom.xml

# Generate from a project
dotnet-CycloneDX src/MyApp/MyApp.csproj -o bom.xml

# Install the CycloneDX .NET global tool
dotnet tool install --global CycloneDX

# Verify installation
dotnet-CycloneDX --version

# Update to latest version
dotnet tool update --global CycloneDX

# Initialize tool manifest (if not exists)
dotnet new tool-manifest

# Install locally
dotnet tool install CycloneDX

# Restore tools from manifest
dotnet tool restore

# Use local tool
dotnet-CycloneDX

# Install Syft (cross-platform)
curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin

# Verify .NET detection capability
syft --help

# SPDX tooling is format-oriented rather than .NET-specific
pip install spdx-tools

<!-- Add to Directory.Build.props -->
<Project>
  <Target Name="GenerateSBOM" BeforeTargets="Build">
    <Exec Command="dotnet-CycloneDX &quot;$(MSBuildProjectDirectory)&quot; -o &quot;$(MSBuildProjectDirectory)&quot;" 
          WorkingDirectory="$(MSBuildProjectDirectory)" />
  </Target>
</Project>

// .vscode/tasks.json
{
    "version": "2.0.0",
    "tasks": [
        {
            "label": "Generate SBOM",
            "type": "shell",
            "command": "dotnet-CycloneDX",
            "args": [
                ".",
                "-o", "."
            ],
            "group": {
                "kind": "build",
                "isDefault": false
            },
            "presentation": {
                "echo": true,
                "reveal": "always",
                "focus": false,
                "panel": "shared",
                "clear": true
            },
            "problemMatcher": []
        }
    ]
}

<!-- Add to .csproj or Directory.Build.targets -->
<Target Name="GenerateSBOM" AfterTargets="Build" Condition="'$(Configuration)' == 'Release'">
  <Exec Command="dotnet-CycloneDX &quot;$(MSBuildProjectDirectory)&quot; -o &quot;$(OutputPath)&quot;" 
        ContinueOnError="false" />
  <ItemGroup>
    <None Include="$(OutputPath)bom.xml">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
  </ItemGroup>
</Target>

# Navigate to project directory
cd MyConsoleApp

# Generate basic SBOM
dotnet-CycloneDX . -o .

# Generate JSON output recursively
dotnet-CycloneDX . \
  -o . \
  -F Json \
  -rs

# Generate SBOM for Web API
cd MyWebApi

# Generate JSON output
dotnet-CycloneDX . \
  -o sboms \
  -fn webapi-sbom.json \
  -F Json \
  -rs

# Generate SBOM for reusable library
cd MyLibrary

dotnet-CycloneDX . \
  -o sboms \
  -fn library-sbom.json \
  -F Json \
  --exclude-dev \
  -rs

# Generate SBOM for entire solution
dotnet-CycloneDX MySolution.sln \
  -o sboms \
  -fn solution-sbom.json \
  -F Json \
  -rs

# Generate per-project SBOMs
for project in $(find . -name "*.csproj"); do
  project_name=$(basename "$project" .csproj)
  dotnet-CycloneDX "$project" \
    -o sboms \
    -fn "${project_name}-sbom.json" \
    -F Json
done

# PowerShell script for Windows environments
# generate-solution-sboms.ps1

param(
    [string]$SolutionPath = ".",
    [string]$OutputDir = "sboms",
    [switch]$IncludeTests = $false
)

# Ensure output directory exists
New-Item -ItemType Directory -Force -Path $OutputDir | Out-Null

# Find all project files
$projects = Get-ChildItem -Path $SolutionPath -Include "*.csproj" -Recurse

foreach ($project in $projects) {
    $projectName = [System.IO.Path]::GetFileNameWithoutExtension($project.Name)

    # Skip test projects unless explicitly included
    if (-not $IncludeTests -and $projectName -match "Test|Tests|UnitTest") {
        Write-Host "Skipping test project: $projectName" -ForegroundColor Yellow
        continue
    }

    Write-Host "Generating SBOM for: $projectName" -ForegroundColor Green

    $outputFile = "$projectName-sbom.json"

    & dotnet-CycloneDX $project.FullName `
        -o $OutputDir `
        -fn $outputFile `
        -F Json `
        -rs

    if ($LASTEXITCODE -eq 0) {
        Write-Host "✅ Generated: $outputFile" -ForegroundColor Green
    } else {
        Write-Host "❌ Failed to generate SBOM for $projectName" -ForegroundColor Red
    }
}

Write-Host "SBOM generation complete. Files saved to: $OutputDir" -ForegroundColor Cyan

# List all packages with vulnerabilities
dotnet list package --vulnerable

# List outdated packages
dotnet list package --outdated

# Generate detailed package report
dotnet list package --include-transitive > package-report.txt

# Create SBOM with package details
dotnet-CycloneDX . \
  -o sboms \
  -fn detailed-sbom.json \
  -F Json \
  -rs

<!-- NuGet.Config with multiple sources -->
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="private-feed" value="https://pkgs.dev.azure.com/company/_packaging/internal/nuget/v3/index.json" />
    <add key="local-packages" value="./local-packages" />
  </packageSources>
  <packageSourceMapping>
    <packageSource key="nuget.org">
      <package pattern="Microsoft.*" />
      <package pattern="Newtonsoft.*" />
    </packageSource>
    <packageSource key="private-feed">
      <package pattern="Company.*" />
    </packageSource>
  </packageSourceMapping>
</configuration>

# Restore against the desired NuGet config, then generate the SBOM
dotnet restore --configfile NuGet.Config
dotnet-CycloneDX . \
  -o sboms \
  -fn sourced-sbom.json \
  -F Json

<!-- Multi-targeting project file -->
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFrameworks>net6.0;net48;netstandard2.0</TargetFrameworks>
    <LangVersion>latest</LangVersion>
  </PropertyGroup>

  <!-- Framework-specific packages -->
  <ItemGroup Condition="'$(TargetFramework)' == 'net48'">
    <PackageReference Include="System.Text.Json" Version="8.0.4" />
  </ItemGroup>

  <ItemGroup Condition="'$(TargetFramework)' == 'net6.0'">
    <PackageReference Include="Microsoft.Extensions.Hosting" Version="8.0.0" />
  </ItemGroup>

  <!-- Universal packages -->
  <ItemGroup>
    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
  </ItemGroup>
</Project>

# Generate SBOMs for each target framework
for framework in net6.0 net48 netstandard2.0; do
  dotnet-CycloneDX . \
    -o sboms \
    -fn "mylib-${framework}-sbom.json" \
    -F Json
done

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <Environment Condition="'$(Environment)' == ''">Development</Environment>
  </PropertyGroup>

  <!-- Development dependencies -->
  <ItemGroup Condition="'$(Environment)' == 'Development'">
    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="8.0.0" PrivateAssets="all" />
    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.5.0" />
  </ItemGroup>

  <!-- Production dependencies -->
  <ItemGroup Condition="'$(Environment)' == 'Production'">
    <PackageReference Include="Azure.Identity" Version="1.10.4" />
    <PackageReference Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.2.2" />
  </ItemGroup>

  <!-- Universal dependencies -->
  <ItemGroup>
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.0" />
    <PackageReference Include="Serilog.Extensions.Hosting" Version="7.0.0" />
  </ItemGroup>
</Project>

# Generate environment-specific SBOMs
environments=("Development" "Staging" "Production")

for env in "${environments[@]}"; do
  dotnet build -p:Environment="$env"
  dotnet-CycloneDX . \
    -o sboms \
    -fn "webapp-${env,,}-sbom.json" \
    -F Json \
    -rs
done

# Build stage with SBOM generation
FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src

# Copy project files
COPY ["MyApp/MyApp.csproj", "MyApp/"]
COPY ["MyApp.Tests/MyApp.Tests.csproj", "MyApp.Tests/"]

# Restore packages
RUN dotnet restore "MyApp/MyApp.csproj"

# Copy source code
COPY . .

# Install CycloneDX tool
RUN dotnet tool install --global CycloneDX
ENV PATH="${PATH}:/root/.dotnet/tools"

# Build application
RUN dotnet build "MyApp/MyApp.csproj" -c Release -o /app/build

# Generate SBOM
RUN dotnet-CycloneDX /src/MyApp \
    -o /app/build \
    -fn sbom.json \
    -F Json

# Publish stage
FROM build AS publish
RUN dotnet publish "MyApp/MyApp.csproj" -c Release -o /app/publish

# Runtime stage
FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
WORKDIR /app
COPY --from=publish /app/publish .
COPY --from=build /app/build/sbom.json ./sbom.json

EXPOSE 80
EXPOSE 443
ENTRYPOINT ["dotnet", "MyApp.dll"]

# Build container with SBOM
docker build -t myapp:latest .

# Extract SBOM from container
docker create --name temp-container myapp:latest
docker cp temp-container:/app/sbom.json ./container-sbom.json
docker rm temp-container

# Analyze container layers with Syft
syft myapp:latest -o cyclonedx-json=container-analysis.json

# Compare application SBOM vs. container SBOM
python3 compare-sboms.py container-sbom.json container-analysis.json

# azure-pipelines.yml
trigger:
  branches:
    include:
      - main
      - develop
  paths:
    exclude:
      - README.md
      - docs/*

variables:
  BuildConfiguration: 'Release'
  DotNetVersion: '8.0.x'
  SBOM_OUTPUT_DIR: '$(Build.ArtifactStagingDirectory)/sboms'

stages:
- stage: Build
  displayName: 'Build and Test'
  jobs:
  - job: BuildJob
    displayName: 'Build .NET Application'
    pool:
      vmImage: 'ubuntu-latest'

    steps:
    - task: UseDotNet@2
      displayName: 'Use .NET SDK'
      inputs:
        packageType: 'sdk'
        version: '$(DotNetVersion)'

    - task: DotNetCoreCLI@2
      displayName: 'Restore packages'
      inputs:
        command: 'restore'
        projects: '**/*.csproj'
        verbosityRestore: 'Minimal'

    - task: DotNetCoreCLI@2
      displayName: 'Build solution'
      inputs:
        command: 'build'
        projects: '**/*.sln'
        arguments: '--configuration $(BuildConfiguration) --no-restore'

    - task: DotNetCoreCLI@2
      displayName: 'Run tests'
      inputs:
        command: 'test'
        projects: '**/*Tests.csproj'
        arguments: '--configuration $(BuildConfiguration) --no-build --collect:"XPlat Code Coverage"'
        publishTestResults: true

    - script: |
        mkdir -p $(SBOM_OUTPUT_DIR)
      displayName: 'Create SBOM output directory'

    - task: DotNetCoreCLI@2
      displayName: 'Install CycloneDX tool'
      inputs:
        command: 'custom'
        custom: 'tool'
        arguments: 'install --global CycloneDX'

    - script: |
        # Generate SBOM for main application
        dotnet-CycloneDX src/MyApp \
          -o $(SBOM_OUTPUT_DIR) \
          -fn myapp-sbom.json \
          -F Json \
          -rs

        # Generate SBOM for entire solution
        dotnet-CycloneDX MyApp.sln \
          -o $(SBOM_OUTPUT_DIR) \
          -fn solution-sbom.json \
          -F Json \
          -rs

        # List generated files
        ls -la $(SBOM_OUTPUT_DIR)/
      displayName: 'Generate SBOMs'

    - script: |
        # Install validation tools
        pip install spdx-tools

        # Validate SBOM quality
        for sbom in $(SBOM_OUTPUT_DIR)/*.json; do
          echo "Validating $sbom"

          # Basic JSON validation
          jq empty "$sbom"

          # Count components
          component_count=$(jq '.components | length' "$sbom")
          echo "Components found: $component_count"

          if [ "$component_count" -eq 0 ]; then
            echo "Warning: No components found in $sbom"
            exit 1
          fi
        done
      displayName: 'Validate SBOMs'

    - task: PublishBuildArtifacts@1
      displayName: 'Publish SBOM artifacts'
      inputs:
        PathtoPublish: '$(SBOM_OUTPUT_DIR)'
        ArtifactName: 'sboms'
        publishLocation: 'Container'

- stage: SecurityScan
  displayName: 'Security Analysis'
  dependsOn: Build
  condition: succeeded()
  jobs:
  - job: ScanJob
    displayName: 'Vulnerability Scanning'
    pool:
      vmImage: 'ubuntu-latest'

    steps:
    - task: DownloadBuildArtifacts@0
      displayName: 'Download SBOM artifacts'
      inputs:
        buildType: 'current'
        downloadType: 'single'
        artifactName: 'sboms'
        downloadPath: '$(System.ArtifactsDirectory)'

    - script: |
        # Install Grype for vulnerability scanning
        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

        # Scan SBOMs for vulnerabilities
        for sbom in $(System.ArtifactsDirectory)/sboms/*.json; do
          sbom_name=$(basename "$sbom" .json)
          echo "Scanning $sbom_name for vulnerabilities..."

          grype sbom:"$sbom" \
            --output json \
            --file "${sbom_name}-vulnerabilities.json"

          grype sbom:"$sbom" \
            --output table \
            --file "${sbom_name}-vulnerabilities.txt"

          # Check for high/critical vulnerabilities
          high_critical=$(jq '[.matches[] | select(.vulnerability.severity == "High" or .vulnerability.severity == "Critical")] | length' "${sbom_name}-vulnerabilities.json")

          echo "High/Critical vulnerabilities: $high_critical"

          if [ "$high_critical" -gt 0 ]; then
            echo "##vso[task.logissue type=warning]$high_critical high/critical vulnerabilities found in $sbom_name"
          fi
        done
      displayName: 'Scan for vulnerabilities'

    - task: PublishBuildArtifacts@1
      displayName: 'Publish security reports'
      inputs:
        PathtoPublish: '$(System.DefaultWorkingDirectory)'
        ArtifactName: 'security-reports'
        publishLocation: 'Container'

- stage: Deploy
  displayName: 'Deploy Application'
  dependsOn: [Build, SecurityScan]
  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
  jobs:
  - deployment: DeployJob
    displayName: 'Deploy to Production'
    environment: 'production'
    pool:
      vmImage: 'ubuntu-latest'
    strategy:
      runOnce:
        deploy:
          steps:
          - task: DownloadBuildArtifacts@0
            displayName: 'Download artifacts'
            inputs:
              buildType: 'current'
              downloadType: 'multiple'
              itemPattern: '**'
              downloadPath: '$(System.ArtifactsDirectory)'

          - script: |
              # Upload SBOM to artifact repository
              curl -X POST \
                -H "Authorization: Bearer $(ARTIFACT_REPO_TOKEN)" \
                -H "Content-Type: application/json" \
                --data-binary @$(System.ArtifactsDirectory)/sboms/myapp-sbom.json \
                "$(ARTIFACT_REPO_URL)/api/v1/sboms/myapp/$(Build.BuildNumber)"

              echo "SBOM uploaded to artifact repository"
            displayName: 'Upload SBOM to repository'
            condition: and(succeeded(), ne(variables['ARTIFACT_REPO_TOKEN'], ''))

# .github/workflows/dotnet-sbom.yml
name: .NET SBOM Generation and Security

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1'  # Weekly security scan

env:
  DOTNET_VERSION: '8.0.x'
  BUILD_CONFIGURATION: 'Release'

jobs:
  build-and-sbom:
    runs-on: ubuntu-latest

    outputs:
      sbom-files: ${{ steps.generate-sbom.outputs.files }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for version calculation

    - name: Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNET_VERSION }}

    - name: Cache NuGet packages
      uses: actions/cache@v3
      with:
        path: ~/.nuget/packages
        key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/packages.lock.json') }}
        restore-keys: |
          ${{ runner.os }}-nuget-

    - name: Restore dependencies
      run: dotnet restore --verbosity minimal

    - name: Build solution
      run: dotnet build --configuration ${{ env.BUILD_CONFIGURATION }} --no-restore

    - name: Run tests
      run: dotnet test --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --verbosity minimal

    - name: Install CycloneDX
      run: dotnet tool install --global CycloneDX

    - name: Generate version
      id: version
      run: |
        if [[ "${{ github.ref }}" == refs/tags/* ]]; then
          VERSION=${GITHUB_REF#refs/tags/}
        else
          VERSION="${{ github.sha }}"
        fi
        echo "version=$VERSION" >> $GITHUB_OUTPUT

    - name: Generate SBOMs
      id: generate-sbom
      run: |
        mkdir -p sboms

        # Find all project files
        projects=($(find . -name "*.csproj" -not -path "*/bin/*" -not -path "*/obj/*"))
        sbom_files=()

        for project in "${projects[@]}"; do
          project_name=$(basename "$project" .csproj)

          # Skip test projects for main SBOM
          if [[ "$project_name" == *"Test"* ]] || [[ "$project_name" == *"Tests"* ]]; then
            echo "Skipping test project: $project_name"
            continue
          fi

          echo "Generating SBOM for: $project_name"

          sbom_file="sboms/${project_name}-sbom.json"
          dotnet-CycloneDX "$project" \
            -o sboms \
            -fn "${project_name}-sbom.json" \
            -F Json \
            -rs

          if [[ -f "$sbom_file" ]]; then
            sbom_files+=("$sbom_file")
            echo "✅ Generated: $sbom_file"
          else
            echo "❌ Failed to generate: $sbom_file"
            exit 1
          fi
        done

        # Generate solution-wide SBOM if solution file exists
        if [[ -f *.sln ]]; then
          solution_file=$(ls *.sln | head -1)
          solution_name=$(basename "$solution_file" .sln)

          echo "Generating solution SBOM for: $solution_name"

          dotnet-CycloneDX "$solution_file" \
            -o sboms \
            -fn "${solution_name}-solution-sbom.json" \
            -F Json \
            -rs

          sbom_files+=("sboms/${solution_name}-solution-sbom.json")
        fi

        # Output file list for next jobs
        printf -v joined '%s,' "${sbom_files[@]}"
        echo "files=${joined%,}" >> $GITHUB_OUTPUT

        echo "Generated SBOMs:"
        ls -la sboms/

    - name: Validate SBOMs
      run: |
        for sbom in sboms/*.json; do
          echo "Validating $sbom"

          # JSON validation
          jq empty "$sbom" || exit 1

          # Component count validation
          component_count=$(jq '.components | length' "$sbom")
          echo "  Components: $component_count"

          if [[ "$component_count" -eq 0 ]]; then
            echo "  ⚠️ Warning: No components found"
          else
            echo "  ✅ Valid SBOM with $component_count components"
          fi

          # License analysis
          licenses=$(jq -r '.components[]?.licenses[]?.license.name // empty' "$sbom" | sort -u | wc -l)
          echo "  Unique licenses: $licenses"
        done

    - name: Upload SBOM artifacts
      uses: actions/upload-artifact@v4
      with:
        name: sboms
        path: sboms/
        retention-days: 30

  security-scan:
    runs-on: ubuntu-latest
    needs: build-and-sbom
    if: success()

    steps:
    - name: Download SBOM artifacts
      uses: actions/download-artifact@v4
      with:
        name: sboms
        path: sboms/

    - name: Install security tools
      run: |
        # Install Grype
        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

        # Install Syft for additional analysis
        curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin

    - name: Vulnerability scan
      id: vuln-scan
      run: |
        mkdir -p security-reports

        total_vulnerabilities=0
        critical_high_vulnerabilities=0

        for sbom in sboms/*.json; do
          sbom_name=$(basename "$sbom" .json)
          echo "🔍 Scanning $sbom_name for vulnerabilities..."

          # Grype vulnerability scan
          grype sbom:"$sbom" \
            --output json \
            --file "security-reports/${sbom_name}-vulnerabilities.json"

          grype sbom:"$sbom" \
            --output table \
            --file "security-reports/${sbom_name}-vulnerabilities.txt"

          # Count vulnerabilities
          vuln_count=$(jq '.matches | length' "security-reports/${sbom_name}-vulnerabilities.json")
          critical_high_count=$(jq '[.matches[] | select(.vulnerability.severity == "Critical" or .vulnerability.severity == "High")] | length' "security-reports/${sbom_name}-vulnerabilities.json")

          echo "  Total vulnerabilities: $vuln_count"
          echo "  Critical/High: $critical_high_count"

          total_vulnerabilities=$((total_vulnerabilities + vuln_count))
          critical_high_vulnerabilities=$((critical_high_vulnerabilities + critical_high_count))
        done

        echo "total-vulnerabilities=$total_vulnerabilities" >> $GITHUB_OUTPUT
        echo "critical-high-vulnerabilities=$critical_high_vulnerabilities" >> $GITHUB_OUTPUT

        # Create summary report
        cat > security-reports/summary.md << EOF
        # Security Scan Summary

        - **Total Vulnerabilities**: $total_vulnerabilities
        - **Critical/High Severity**: $critical_high_vulnerabilities
        - **Scan Date**: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
        - **Repository**: ${{ github.repository }}
        - **Branch**: ${{ github.ref_name }}
        - **Commit**: ${{ github.sha }}

        ## Recommendations

        EOF

        if [[ "$critical_high_vulnerabilities" -gt 0 ]]; then
          echo "⚠️ **Action Required**: $critical_high_vulnerabilities critical/high severity vulnerabilities found." >> security-reports/summary.md
          echo "Review the detailed reports and update affected packages." >> security-reports/summary.md
        else
          echo "✅ **Good**: No critical or high severity vulnerabilities found." >> security-reports/summary.md
        fi

    - name: Upload security reports
      uses: actions/upload-artifact@v4
      with:
        name: security-reports
        path: security-reports/

    - name: Comment on PR
      if: github.event_name == 'pull_request'
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const summaryPath = 'security-reports/summary.md';

          if (fs.existsSync(summaryPath)) {
            const summary = fs.readFileSync(summaryPath, 'utf8');

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## .NET SBOM Security Scan Results\n\n${summary}\n\n📄 Detailed reports available in job artifacts.`
            });
          }

    - name: Security gate
      if: steps.vuln-scan.outputs.critical-high-vulnerabilities > 0
      run: |
        echo "❌ Security gate failed: ${{ steps.vuln-scan.outputs.critical-high-vulnerabilities }} critical/high vulnerabilities found"
        echo "Please review and address security vulnerabilities before proceeding."
        exit 1

  publish-sbom:
    runs-on: ubuntu-latest
    needs: [build-and-sbom, security-scan]
    if: github.ref == 'refs/heads/main' && success()

    steps:
    - name: Download SBOM artifacts
      uses: actions/download-artifact@v4
      with:
        name: sboms
        path: sboms/

    - name: Sign SBOMs
      if: secrets.GPG_PRIVATE_KEY != ''
      run: |
        echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import

        for sbom in sboms/*.json; do
          gpg --armor --detach-sign "$sbom"
          echo "Signed: $sbom"
        done

    - name: Upload to release
      if: startsWith(github.ref, 'refs/tags/')
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: |
        # Create release if it doesn't exist
        gh release create ${{ github.ref_name }} --generate-notes || true

        # Upload all SBOM files to release
        for file in sboms/*; do
          gh release upload ${{ github.ref_name }} "$file" --clobber
        done

    - name: Publish to SBOM registry
      if: secrets.SBOM_REGISTRY_TOKEN != ''
      run: |
        for sbom in sboms/*.json; do
          sbom_name=$(basename "$sbom" .json)

          curl -X POST \
            -H "Authorization: Bearer ${{ secrets.SBOM_REGISTRY_TOKEN }}" \
            -H "Content-Type: application/json" \
            --data-binary @"$sbom" \
            "${{ secrets.SBOM_REGISTRY_URL }}/api/v1/sboms/${{ github.repository }}/$sbom_name/${{ github.sha }}"

          echo "Uploaded $sbom_name to SBOM registry"
        done

<!-- Directory.Build.targets -->
<Project>
  <!-- SBOM generation properties -->
  <PropertyGroup>
    <SBOMOutputDir>$(OutputPath)sbom</SBOMOutputDir>
    <SBOMFormat>json</SBOMFormat>
    <GenerateSBOMOnBuild Condition="'$(Configuration)' == 'Release'">true</GenerateSBOMOnBuild>
  </PropertyGroup>

  <!-- Create SBOM output directory -->
  <Target Name="CreateSBOMDirectory" BeforeTargets="GenerateSBOM">
    <MakeDir Directories="$(SBOMOutputDir)" Condition="!Exists('$(SBOMOutputDir)')" />
  </Target>

  <!-- Generate SBOM -->
  <Target Name="GenerateSBOM" 
          AfterTargets="Build" 
          Condition="'$(GenerateSBOMOnBuild)' == 'true'"
          DependsOnTargets="CreateSBOMDirectory">

    <PropertyGroup>
      <SBOMFileName>$(AssemblyName)-sbom.$(SBOMFormat)</SBOMFileName>
      <SBOMFilePath>$(SBOMOutputDir)\$(SBOMFileName)</SBOMFilePath>
    </PropertyGroup>

    <Message Text="Generating SBOM: $(SBOMFilePath)" Importance="high" />

    <Exec Command="dotnet-CycloneDX &quot;$(MSBuildProjectDirectory)&quot; -o &quot;$(SBOMOutputDir)&quot; -fn &quot;$(SBOMFileName)&quot; -F Json -rs"
          ContinueOnError="false" />

    <Message Text="SBOM generated successfully: $(SBOMFilePath)" Importance="high" />

    <!-- Add SBOM to output files -->
    <ItemGroup>
      <None Include="$(SBOMFilePath)">
        <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
        <Pack>true</Pack>
        <PackagePath>sbom\</PackagePath>
      </None>
    </ItemGroup>
  </Target>

  <!-- Validate SBOM quality -->
  <Target Name="ValidateSBOM" AfterTargets="GenerateSBOM" Condition="Exists('$(SBOMFilePath)')">
    <Message Text="Validating SBOM: $(SBOMFilePath)" Importance="high" />

    <!-- Custom validation script -->
    <Exec Command="powershell -File &quot;$(MSBuildThisFileDirectory)scripts\validate-sbom.ps1&quot; -SbomPath &quot;$(SBOMFilePath)&quot;"
          ContinueOnError="true" />
  </Target>
</Project>

# scripts/validate-sbom.ps1
param(
    [Parameter(Mandatory=$true)]
    [string]$SbomPath
)

Write-Host "🔍 Validating SBOM: $SbomPath"

if (-not (Test-Path $SbomPath)) {
    Write-Error "SBOM file not found: $SbomPath"
    exit 1
}

try {
    # Parse JSON
    $sbom = Get-Content $SbomPath | ConvertFrom-Json

    # Basic structure validation
    $required_fields = @('bomFormat', 'specVersion', 'serialNumber', 'version', 'metadata')

    foreach ($field in $required_fields) {
        if (-not $sbom.PSObject.Properties[$field]) {
            Write-Warning "Missing required field: $field"
        }
    }

    # Component analysis
    $component_count = 0
    if ($sbom.components) {
        $component_count = $sbom.components.Count
    }

    Write-Host "✅ Components found: $component_count"

    if ($component_count -eq 0) {
        Write-Warning "No components found in SBOM. This may indicate incomplete dependency analysis."
    }

    # License analysis
    $licensed_components = 0
    if ($sbom.components) {
        foreach ($component in $sbom.components) {
            if ($component.licenses -and $component.licenses.Count -gt 0) {
                $licensed_components++
            }
        }
    }

    $license_coverage = if ($component_count -gt 0) { ($licensed_components / $component_count) * 100 } else { 0 }
    Write-Host "📋 License coverage: $([math]::Round($license_coverage, 1))% ($licensed_components/$component_count)"

    if ($license_coverage -lt 50) {
        Write-Warning "Low license coverage. Consider improving license detection."
    }

    # Vulnerability context
    if (Get-Command grype -ErrorAction SilentlyContinue) {
        Write-Host "🔍 Running vulnerability scan..."
        $vuln_output = & grype "sbom:$SbomPath" --output json 2>$null

        if ($LASTEXITCODE -eq 0) {
            $vulnerabilities = $vuln_output | ConvertFrom-Json
            $vuln_count = if ($vulnerabilities.matches) { $vulnerabilities.matches.Count } else { 0 }
            $high_critical = if ($vulnerabilities.matches) { 
                ($vulnerabilities.matches | Where-Object { $_.vulnerability.severity -in @('High', 'Critical') }).Count 
            } else { 0 }

            Write-Host "⚠️  Vulnerabilities found: $vuln_count (High/Critical: $high_critical)"

            if ($high_critical -gt 0) {
                Write-Warning "$high_critical high/critical vulnerabilities detected. Consider updating dependencies."
            }
        }
    }

    Write-Host "✅ SBOM validation completed successfully"

} catch {
    Write-Error "SBOM validation failed: $($_.Exception.Message)"
    exit 1
}

<!-- Directory.Packages.props -->
<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>

  <ItemGroup>
    <!-- Central package versions -->
    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="8.0.0" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
    <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
    <PackageVersion Include="Serilog" Version="3.1.1" />

    <!-- Security-sensitive packages with explicit versions -->
    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.0" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.0" />

    <!-- Development/test packages -->
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
    <PackageVersion Include="xunit" Version="2.4.2" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="2.4.5" />
  </ItemGroup>
</Project>

# Generate SBOM with central package management context
dotnet-CycloneDX . \
  -o . \
  -fn centrally-managed-sbom.json \
  -F Json \
  -rs

// SbomEnhancer.cs - Enhance generated SBOM with additional metadata
using System.Text.Json;
using System.Text.Json.Nodes;

public class SbomEnhancer
{
    public static async Task<JsonNode> EnhanceSbomAsync(string sbomPath, EnhancementOptions options)
    {
        var sbomContent = await File.ReadAllTextAsync(sbomPath);
        var sbom = JsonNode.Parse(sbomContent) ?? throw new InvalidOperationException("Invalid SBOM JSON");

        // Add build environment information
        AddBuildEnvironment(sbom, options);

        // Enhance component information
        await EnhanceComponentsAsync(sbom, options);

        // Add security context
        await AddSecurityContextAsync(sbom, options);

        // Add compliance information
        AddComplianceInformation(sbom, options);

        return sbom;
    }

    private static void AddBuildEnvironment(JsonNode sbom, EnhancementOptions options)
    {
        var metadata = sbom["metadata"]?.AsObject();
        if (metadata == null) return;

        var properties = metadata["properties"]?.AsArray() ?? new JsonArray();

        properties.Add(new JsonObject
        {
            ["name"] = "build.environment",
            ["value"] = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT") ?? "Unknown"
        });

        properties.Add(new JsonObject
        {
            ["name"] = "build.timestamp",
            ["value"] = DateTimeOffset.UtcNow.ToString("O")
        });

        properties.Add(new JsonObject
        {
            ["name"] = "build.machine",
            ["value"] = Environment.MachineName
        });

        properties.Add(new JsonObject
        {
            ["name"] = "dotnet.version",
            ["value"] = Environment.Version.ToString()
        });

        if (options.IncludeGitInfo)
        {
            var gitCommit = Environment.GetEnvironmentVariable("GIT_COMMIT") ?? GetGitCommit();
            var gitBranch = Environment.GetEnvironmentVariable("GIT_BRANCH") ?? GetGitBranch();

            if (!string.IsNullOrEmpty(gitCommit))
            {
                properties.Add(new JsonObject
                {
                    ["name"] = "git.commit",
                    ["value"] = gitCommit
                });
            }

            if (!string.IsNullOrEmpty(gitBranch))
            {
                properties.Add(new JsonObject
                {
                    ["name"] = "git.branch",
                    ["value"] = gitBranch
                });
            }
        }

        metadata["properties"] = properties;
    }

    private static async Task EnhanceComponentsAsync(JsonNode sbom, EnhancementOptions options)
    {
        var components = sbom["components"]?.AsArray();
        if (components == null) return;

        var nugetIndex = await GetNuGetIndexAsync();

        foreach (var component in components.OfType<JsonObject>())
        {
            var name = component["name"]?.ToString();
            var version = component["version"]?.ToString();

            if (string.IsNullOrEmpty(name)) continue;

            // Enhance with NuGet metadata
            if (options.EnhanceWithNuGetMetadata && nugetIndex != null)
            {
                var packageInfo = await GetNuGetPackageInfoAsync(nugetIndex, name, version);
                if (packageInfo != null)
                {
                    // Add download count
                    if (packageInfo.DownloadCount.HasValue)
                    {
                        var properties = component["properties"]?.AsArray() ?? new JsonArray();
                        properties.Add(new JsonObject
                        {
                            ["name"] = "nuget.downloadCount",
                            ["value"] = packageInfo.DownloadCount.ToString()
                        });
                        component["properties"] = properties;
                    }

                    // Add project URL if missing
                    if (string.IsNullOrEmpty(component["externalReferences"]?.ToString()) && 
                        !string.IsNullOrEmpty(packageInfo.ProjectUrl))
                    {
                        var externalRefs = new JsonArray
                        {
                            new JsonObject
                            {
                                ["type"] = "website",
                                ["url"] = packageInfo.ProjectUrl
                            }
                        };
                        component["externalReferences"] = externalRefs;
                    }
                }
            }

            // Add deprecation warnings
            if (options.CheckForDeprecatedPackages)
            {
                var isDeprecated = await IsPackageDeprecatedAsync(name, version);
                if (isDeprecated)
                {
                    var properties = component["properties"]?.AsArray() ?? new JsonArray();
                    properties.Add(new JsonObject
                    {
                        ["name"] = "package.deprecated",
                        ["value"] = "true"
                    });
                    component["properties"] = properties;
                }
            }
        }
    }

    private static async Task AddSecurityContextAsync(JsonNode sbom, EnhancementOptions options)
    {
        if (!options.IncludeSecurityContext) return;

        var vulnerabilities = await ScanForVulnerabilitiesAsync(sbom);

        if (vulnerabilities.Any())
        {
            var vulnArray = new JsonArray();

            foreach (var vuln in vulnerabilities)
            {
                vulnArray.Add(new JsonObject
                {
                    ["id"] = vuln.Id,
                    ["source"] = vuln.Source,
                    ["severity"] = vuln.Severity,
                    ["affectedComponent"] = vuln.AffectedComponent
                });
            }

            sbom["vulnerabilities"] = vulnArray;
        }
    }

    private static void AddComplianceInformation(JsonNode sbom, EnhancementOptions options)
    {
        if (!options.IncludeComplianceInfo) return;

        var metadata = sbom["metadata"]?.AsObject();
        if (metadata == null) return;

        var properties = metadata["properties"]?.AsArray() ?? new JsonArray();

        properties.Add(new JsonObject
        {
            ["name"] = "compliance.standard",
            ["value"] = "CycloneDX-1.5"
        });

        properties.Add(new JsonObject
        {
            ["name"] = "compliance.generator",
            ["value"] = "CycloneDX .NET Tool with Custom Enhancement"
        });

        if (options.ComplianceFrameworks?.Any() == true)
        {
            foreach (var framework in options.ComplianceFrameworks)
            {
                properties.Add(new JsonObject
                {
                    ["name"] = $"compliance.framework.{framework.ToLowerInvariant()}",
                    ["value"] = "assessed"
                });
            }
        }

        metadata["properties"] = properties;
    }

    // Helper methods (implementation details omitted for brevity)
    private static string? GetGitCommit() => 
        RunCommand("git", "rev-parse HEAD").Trim();

    private static string? GetGitBranch() => 
        RunCommand("git", "rev-parse --abbrev-ref HEAD").Trim();

    private static async Task<NuGetIndex?> GetNuGetIndexAsync() => 
        await NuGetApiClient.GetIndexAsync();

    private static async Task<PackageInfo?> GetNuGetPackageInfoAsync(NuGetIndex index, string name, string? version) =>
        await NuGetApiClient.GetPackageInfoAsync(index, name, version);

    private static async Task<bool> IsPackageDeprecatedAsync(string name, string? version) =>
        await NuGetApiClient.IsDeprecatedAsync(name, version);

    private static async Task<IEnumerable<Vulnerability>> ScanForVulnerabilitiesAsync(JsonNode sbom) =>
        await SecurityScanner.ScanSbomAsync(sbom);

    private static string RunCommand(string command, string arguments)
    {
        var process = Process.Start(new ProcessStartInfo
        {
            FileName = command,
            Arguments = arguments,
            RedirectStandardOutput = true,
            UseShellExecute = false
        });

        process?.WaitForExit();
        return process?.StandardOutput.ReadToEnd() ?? string.Empty;
    }
}

public class EnhancementOptions
{
    public bool IncludeGitInfo { get; set; } = true;
    public bool EnhanceWithNuGetMetadata { get; set; } = true;
    public bool CheckForDeprecatedPackages { get; set; } = true;
    public bool IncludeSecurityContext { get; set; } = true;
    public bool IncludeComplianceInfo { get; set; } = true;
    public string[]? ComplianceFrameworks { get; set; }
}

# Generate base SBOM
dotnet-CycloneDX . -o . -fn base-sbom.json -F Json

# Enhance SBOM with additional metadata
dotnet run --project SbomEnhancer -- \
  --input base-sbom.json \
  --output enhanced-sbom.json \
  --include-git-info \
  --include-security-context \
  --compliance-frameworks SOX,PCI-DSS

# Validate enhanced SBOM
curl -X POST -H "Content-Type: application/json" \
  -d @enhanced-sbom.json \
  https://validator.cyclonedx.org/api/validate

// SbomQualityAnalyzer.cs
public class SbomQualityAnalyzer
{
    public QualityReport AnalyzeSbom(string sbomPath)
    {
        var sbom = JsonSerializer.Deserialize<CycloneDxBom>(File.ReadAllText(sbomPath));
        var report = new QualityReport();

        // Component completeness
        report.ComponentCount = sbom.Components?.Count ?? 0;
        report.ComponentsWithLicenses = sbom.Components?.Count(c => c.Licenses?.Any() == true) ?? 0;
        report.ComponentsWithVersions = sbom.Components?.Count(c => !string.IsNullOrEmpty(c.Version)) ?? 0;
        report.LicenseCoverage = report.ComponentCount > 0 ? 
            (double)report.ComponentsWithLicenses / report.ComponentCount * 100 : 0;

        // Metadata quality
        report.HasCreator = sbom.Metadata?.Authors?.Any() == true;
        report.HasTimestamp = !string.IsNullOrEmpty(sbom.Metadata?.Timestamp);
        report.HasNamespace = !string.IsNullOrEmpty(sbom.SerialNumber);

        // Dependency relationships
        report.RelationshipCount = sbom.Dependencies?.Count ?? 0;
        report.HasDependencyGraph = report.RelationshipCount > 0;

        // Security context
        report.VulnerabilityCount = sbom.Vulnerabilities?.Count ?? 0;
        report.HasSecurityAssessment = report.VulnerabilityCount >= 0; // Even 0 vulns is an assessment

        // Calculate overall score
        report.OverallScore = CalculateQualityScore(report);
        report.Grade = GetGrade(report.OverallScore);

        return report;
    }

    private double CalculateQualityScore(QualityReport report)
    {
        double score = 0;

        // Component quality (40% of score)
        if (report.ComponentCount > 0)
        {
            score += 20; // Has components
            score += Math.Min(20, report.LicenseCoverage * 0.2); // License coverage
        }

        // Metadata quality (30% of score)
        if (report.HasCreator) score += 10;
        if (report.HasTimestamp) score += 10;
        if (report.HasNamespace) score += 10;

        // Relationship quality (20% of score)
        if (report.HasDependencyGraph) score += 20;

        // Security assessment (10% of score)
        if (report.HasSecurityAssessment) score += 10;

        return Math.Min(100, score);
    }

    private string GetGrade(double score) => score switch
    {
        >= 90 => "A",
        >= 80 => "B", 
        >= 70 => "C",
        >= 60 => "D",
        _ => "F"
    };
}

public class QualityReport
{
    public int ComponentCount { get; set; }
    public int ComponentsWithLicenses { get; set; }
    public int ComponentsWithVersions { get; set; }
    public double LicenseCoverage { get; set; }
    public bool HasCreator { get; set; }
    public bool HasTimestamp { get; set; }
    public bool HasNamespace { get; set; }
    public int RelationshipCount { get; set; }
    public bool HasDependencyGraph { get; set; }
    public int VulnerabilityCount { get; set; }
    public bool HasSecurityAssessment { get; set; }
    public double OverallScore { get; set; }
    public string Grade { get; set; } = string.Empty;
}

# sbom-governance-policy.yml
version: "1.0"
name: "Enterprise .NET SBOM Policy"
description: "Governance policies for .NET application SBOMs"

metadata_requirements:
  required_fields:
    - serialNumber
    - version
    - metadata.timestamp
    - metadata.component.name
    - metadata.component.version

  required_creators:
    - tool_pattern: "CycloneDX.*"
    - organization: "Company Name"

component_policies:
  minimum_component_count: 5
  license_coverage_threshold: 80.0

  required_component_fields:
    - name
    - version
    - purl
    - type

  license_policies:
    approved:
      - "MIT"
      - "Apache-2.0"
      - "BSD-2-Clause"
      - "BSD-3-Clause"

    restricted:
      - "GPL-2.0"
      - "GPL-3.0"
      - "LGPL-2.1"
      - "LGPL-3.0"

    forbidden:
      - "AGPL-3.0"
      - "GPL-2.0-only"
      - "GPL-3.0-only"

security_policies:
  max_critical_vulnerabilities: 0
  max_high_vulnerabilities: 5
  max_medium_vulnerabilities: 20

  vulnerability_age_limits:
    critical_days: 7
    high_days: 30
    medium_days: 90

quality_gates:
  minimum_overall_score: 80.0
  minimum_license_coverage: 75.0
  require_dependency_graph: true
  require_security_assessment: true

compliance_frameworks:
  - name: "SOX"
    requirements:
      - complete_license_inventory
      - change_audit_trail
      - quarterly_reviews

  - name: "PCI-DSS"
    requirements:
      - vulnerability_scanning
      - security_patch_management
      - third_party_risk_assessment

exemptions:
  packages:
    - name: "legacy-internal-lib"
      reason: "Internal package under migration"
      expiry: "2026-12-31"

    - name: "vendor-proprietary-sdk"
      reason: "Commercial license reviewed by legal"
      approved_by: "legal-team@company.com"

notifications:
  policy_violations:
    - type: "email"
      recipients: ["security-team@company.com"]
    - type: "slack"
      channel: "#security-alerts"

  compliance_reviews:
    - type: "jira"
      project: "COMPLIANCE"
      assignee: "compliance-team"

// PolicyEnforcementEngine.cs
public class PolicyEnforcementEngine
{
    private readonly PolicyConfiguration _policy;

    public PolicyEnforcementEngine(PolicyConfiguration policy)
    {
        _policy = policy;
    }

    public PolicyEvaluationResult EvaluateSbom(string sbomPath)
    {
        var sbom = LoadSbom(sbomPath);
        var result = new PolicyEvaluationResult { SbomPath = sbomPath };

        // Evaluate metadata requirements
        EvaluateMetadata(sbom, result);

        // Evaluate component policies
        EvaluateComponents(sbom, result);

        // Evaluate security policies
        EvaluateSecurity(sbom, result);

        // Evaluate quality gates
        EvaluateQuality(sbom, result);

        // Determine overall compliance
        result.IsCompliant = !result.Violations.Any(v => v.Severity == ViolationSeverity.Critical);
        result.Score = CalculateComplianceScore(result);

        return result;
    }

    private void EvaluateMetadata(CycloneDxBom sbom, PolicyEvaluationResult result)
    {
        // Check required fields
        foreach (var field in _policy.MetadataRequirements.RequiredFields)
        {
            if (!HasField(sbom, field))
            {
                result.AddViolation(ViolationSeverity.High, $"Missing required field: {field}");
            }
        }

        // Check required creators
        var creators = sbom.Metadata?.Authors ?? new List<OrganizationalContact>();
        foreach (var requiredCreator in _policy.MetadataRequirements.RequiredCreators)
        {
            if (!creators.Any(c => MatchesCreatorPattern(c, requiredCreator)))
            {
                result.AddViolation(ViolationSeverity.Medium, 
                    $"Missing required creator: {requiredCreator}");
            }
        }
    }

    private void EvaluateComponents(CycloneDxBom sbom, PolicyEvaluationResult result)
    {
        var components = sbom.Components ?? new List<Component>();

        // Check minimum component count
        if (components.Count < _policy.ComponentPolicies.MinimumComponentCount)
        {
            result.AddViolation(ViolationSeverity.High, 
                $"Insufficient components: {components.Count} < {_policy.ComponentPolicies.MinimumComponentCount}");
        }

        // Check license coverage
        var licensedComponents = components.Count(c => c.Licenses?.Any() == true);
        var licenseCoverage = components.Count > 0 ? (double)licensedComponents / components.Count * 100 : 0;

        if (licenseCoverage < _policy.ComponentPolicies.LicenseCoverageThreshold)
        {
            result.AddViolation(ViolationSeverity.Medium, 
                $"Low license coverage: {licenseCoverage:F1}% < {_policy.ComponentPolicies.LicenseCoverageThreshold}%");
        }

        // Check individual component licenses
        foreach (var component in components)
        {
            CheckComponentLicenses(component, result);
        }
    }

    private void CheckComponentLicenses(Component component, PolicyEvaluationResult result)
    {
        var licenses = component.Licenses?.SelectMany(l => GetLicenseIdentifiers(l)) ?? Enumerable.Empty<string>();

        foreach (var license in licenses)
        {
            if (_policy.ComponentPolicies.LicensePolicies.Forbidden.Contains(license))
            {
                result.AddViolation(ViolationSeverity.Critical, 
                    $"Forbidden license in {component.Name}: {license}");
            }
            else if (_policy.ComponentPolicies.LicensePolicies.Restricted.Contains(license))
            {
                result.AddViolation(ViolationSeverity.High, 
                    $"Restricted license in {component.Name}: {license} (requires review)");
            }
        }
    }

    private void EvaluateSecurity(CycloneDxBom sbom, PolicyEvaluationResult result)
    {
        var vulnerabilities = sbom.Vulnerabilities ?? new List<Vulnerability>();

        var criticalCount = vulnerabilities.Count(v => v.Ratings?.Any(r => r.Severity == Severity.Critical) == true);
        var highCount = vulnerabilities.Count(v => v.Ratings?.Any(r => r.Severity == Severity.High) == true);
        var mediumCount = vulnerabilities.Count(v => v.Ratings?.Any(r => r.Severity == Severity.Medium) == true);

        if (criticalCount > _policy.SecurityPolicies.MaxCriticalVulnerabilities)
        {
            result.AddViolation(ViolationSeverity.Critical, 
                $"Too many critical vulnerabilities: {criticalCount} > {_policy.SecurityPolicies.MaxCriticalVulnerabilities}");
        }

        if (highCount > _policy.SecurityPolicies.MaxHighVulnerabilities)
        {
            result.AddViolation(ViolationSeverity.High, 
                $"Too many high vulnerabilities: {highCount} > {_policy.SecurityPolicies.MaxHighVulnerabilities}");
        }

        if (mediumCount > _policy.SecurityPolicies.MaxMediumVulnerabilities)
        {
            result.AddViolation(ViolationSeverity.Medium, 
                $"Too many medium vulnerabilities: {mediumCount} > {_policy.SecurityPolicies.MaxMediumVulnerabilities}");
        }
    }

    // Additional methods omitted for brevity...
}

#!/bin/bash
# .git/hooks/pre-commit - Generate SBOM before each commit

echo "🔍 Generating SBOM for .NET projects..."

# Find all .NET project files
projects=($(find . -name "*.csproj" -not -path "*/bin/*" -not -path "*/obj/*"))

if [ ${#projects[@]} -eq 0 ]; then
    echo "No .NET projects found, skipping SBOM generation"
    exit 0
fi

# Ensure CycloneDX is available
if ! command -v dotnet-CycloneDX &> /dev/null; then
    echo "Installing CycloneDX .NET tool..."
    dotnet tool install --global CycloneDX
fi

# Generate SBOMs for changed projects
sbom_generated=false

for project in "${projects[@]}"; do
    project_dir=$(dirname "$project")
    project_name=$(basename "$project" .csproj)

    # Check if project or its dependencies have changed
    if git diff --cached --name-only | grep -q "^${project_dir}/"; then
        echo "Generating SBOM for $project_name..."

        dotnet-CycloneDX "$project" \
            -o "$project_dir" \
            -fn sbom.json \
            -F Json \
            -rs

        if [ $? -eq 0 ]; then
            git add "${project_dir}/sbom.json"
            sbom_generated=true
        else
            echo "❌ Failed to generate SBOM for $project_name"
            exit 1
        fi
    fi
done

if [ "$sbom_generated" = true ]; then
    echo "✅ SBOMs generated and staged for commit"
else
    echo "ℹ️ No SBOM changes needed"
fi

# audit-dependencies.ps1 - Comprehensive dependency audit
param(
    [string]$ProjectPath = ".",
    [switch]$FixVulnerabilities = $false,
    [string]$OutputFormat = "json"
)

Write-Host "🔍 .NET Dependency Security Audit" -ForegroundColor Cyan
Write-Host "================================="

# Find all project files
$projects = Get-ChildItem -Path $ProjectPath -Include "*.csproj" -Recurse

foreach ($project in $projects) {
    $projectName = [System.IO.Path]::GetFileNameWithoutExtension($project.Name)
    Write-Host "`n📦 Analyzing: $projectName" -ForegroundColor Yellow

    Push-Location $project.Directory

    try {
        # Check for vulnerable packages
        Write-Host "  Checking for vulnerabilities..." -ForegroundColor Gray
        $vulnOutput = dotnet list package --vulnerable --include-transitive --format json 2>$null

        if ($vulnOutput) {
            $vulnData = $vulnOutput | ConvertFrom-Json
            $vulnerablePackages = $vulnData.projects[0].frameworks[0].vulnerablePackages

            if ($vulnerablePackages) {
                Write-Host "  ⚠️  Found $($vulnerablePackages.Count) vulnerable packages" -ForegroundColor Red

                foreach ($package in $vulnerablePackages) {
                    Write-Host "    - $($package.id) $($package.resolvedVersion)" -ForegroundColor Red

                    if ($FixVulnerabilities) {
                        Write-Host "    Attempting to update..." -ForegroundColor Yellow
                        dotnet add package $package.id --version $package.latestVersion
                    }
                }
            } else {
                Write-Host "  ✅ No vulnerable packages found" -ForegroundColor Green
            }
        }

        # Check for outdated packages
        Write-Host "  Checking for outdated packages..." -ForegroundColor Gray
        $outdatedOutput = dotnet list package --outdated --include-transitive --format json 2>$null

        if ($outdatedOutput) {
            $outdatedData = $outdatedOutput | ConvertFrom-Json
            $outdatedPackages = $outdatedData.projects[0].frameworks[0].outdatedPackages

            if ($outdatedPackages) {
                Write-Host "  📅 Found $($outdatedPackages.Count) outdated packages" -ForegroundColor Yellow

                foreach ($package in $outdatedPackages) {
                    Write-Host "    - $($package.id): $($package.resolvedVersion) → $($package.latestVersion)" -ForegroundColor Yellow
                }
            } else {
                Write-Host "  ✅ All packages are up to date" -ForegroundColor Green
            }
        }

        # Generate SBOM for analysis
        Write-Host "  Generating SBOM..." -ForegroundColor Gray
        dotnet-CycloneDX . -o . -fn "audit-sbom.json" -F Json -rs 2>$null

        if (Test-Path "audit-sbom.json") {
            $sbom = Get-Content "audit-sbom.json" | ConvertFrom-Json
            $componentCount = if ($sbom.components) { $sbom.components.Count } else { 0 }
            Write-Host "  📋 SBOM generated with $componentCount components" -ForegroundColor Green

            # License analysis
            $licenses = @{}
            foreach ($component in $sbom.components) {
                if ($component.licenses) {
                    foreach ($license in $component.licenses) {
                        $licenseName = if ($license.license.name) { $license.license.name } else { $license.license.id }
                        $licenses[$licenseName] = ($licenses[$licenseName] ?? 0) + 1
                    }
                }
            }

            if ($licenses.Count -gt 0) {
                Write-Host "  📄 License distribution:" -ForegroundColor Cyan
                foreach ($license in $licenses.GetEnumerator() | Sort-Object Value -Descending) {
                    Write-Host "    - $($license.Key): $($license.Value) packages" -ForegroundColor Cyan
                }
            }

            # Clean up temporary SBOM
            Remove-Item "audit-sbom.json" -Force
        }

    } finally {
        Pop-Location
    }
}

Write-Host "`n✅ Dependency audit completed!" -ForegroundColor Green

if ($FixVulnerabilities) {
    Write-Host "🔧 Vulnerability fixes attempted. Please review and test changes." -ForegroundColor Yellow
    Write-Host "   Run 'dotnet build' and 'dotnet test' to ensure everything still works." -ForegroundColor Yellow
}

#!/bin/bash
# fast-sbom-generation.sh - Optimized SBOM generation for large solutions

SOLUTION_PATH="$1"
OUTPUT_DIR="${2:-sboms}"
PARALLEL_JOBS="${3:-4}"

if [ -z "$SOLUTION_PATH" ]; then
    echo "Usage: $0 <solution-path> [output-dir] [parallel-jobs]"
    exit 1
fi

echo "🚀 Fast SBOM Generation for Large Solutions"
echo "==========================================="
echo "Solution: $SOLUTION_PATH"
echo "Output: $OUTPUT_DIR"
echo "Parallel jobs: $PARALLEL_JOBS"
echo ""

# Create output directory
mkdir -p "$OUTPUT_DIR"

# Function to generate SBOM for a single project
generate_project_sbom() {
    local project_file="$1"
    local project_name=$(basename "$project_file" .csproj)
    local output_file="$OUTPUT_DIR/${project_name}-sbom.json"

    echo "📦 Generating SBOM for: $project_name"

    # Use timeout to prevent hanging
    timeout 300s dotnet-CycloneDX "$project_file" \
        -o "$OUTPUT_DIR" \
        -fn "$(basename "$output_file")" \
        -F Json \
        -rs \
        2>/dev/null

    if [ $? -eq 0 ] && [ -f "$output_file" ]; then
        # Basic validation
        if jq empty "$output_file" 2>/dev/null; then
            local component_count=$(jq '.components | length' "$output_file" 2>/dev/null || echo "0")
            echo "✅ $project_name: $component_count components"
            return 0
        else
            echo "❌ $project_name: Invalid JSON generated"
            rm -f "$output_file"
            return 1
        fi
    else
        echo "❌ $project_name: Generation failed"
        return 1
    fi
}

# Export function for parallel execution
export -f generate_project_sbom
export OUTPUT_DIR

# Find all project files (excluding test projects for main SBOMs)
mapfile -t projects < <(find "$(dirname "$SOLUTION_PATH")" -name "*.csproj" \
    -not -path "*/bin/*" \
    -not -path "*/obj/*" \
    -not -name "*Test*.csproj" \
    -not -name "*Tests.csproj")

echo "Found ${#projects[@]} projects to process"

# Generate SBOMs in parallel
printf '%s\n' "${projects[@]}" | xargs -n 1 -P "$PARALLEL_JOBS" -I {} bash -c 'generate_project_sbom "$@"' _ {}

# Generate solution-wide SBOM
echo ""
echo "📋 Generating solution-wide SBOM..."
dotnet-CycloneDX "$SOLUTION_PATH" \
    -o "$OUTPUT_DIR" \
    -fn "solution-sbom.json" \
    -F Json \
    -rs

# Merge individual SBOMs if needed
echo ""
echo "🔗 Creating merged SBOM..."
python3 - << 'EOF'
import json
import glob
import sys
from datetime import datetime

def merge_sboms(pattern, output_file):
    merged = {
        "bomFormat": "CycloneDX",
        "specVersion": "1.7",
        "serialNumber": f"urn:uuid:merged-{datetime.now().isoformat()}",
        "version": 1,
        "metadata": {
            "timestamp": datetime.now().isoformat() + "Z",
            "tools": [{"name": "fast-sbom-generation.sh", "version": "1.0"}],
            "component": {
                "type": "application",
                "name": "Merged Solution SBOM"
            }
        },
        "components": []
    }

    component_map = {}

    for sbom_file in glob.glob(pattern):
        if sbom_file == output_file:
            continue

        try:
            with open(sbom_file) as f:
                sbom = json.load(f)

            for component in sbom.get('components', []):
                key = f"{component.get('name', '')}@{component.get('version', '')}"
                if key not in component_map:
                    component_map[key] = component
        except Exception as e:
            print(f"Error processing {sbom_file}: {e}", file=sys.stderr)

    merged['components'] = list(component_map.values())

    with open(output_file, 'w') as f:
        json.dump(merged, f, indent=2)

    return len(merged['components'])

try:
    component_count = merge_sboms("sboms/*-sbom.json", "sboms/merged-sbom.json")
    print(f"✅ Merged SBOM created with {component_count} unique components")
except Exception as e:
    print(f"❌ Failed to create merged SBOM: {e}", file=sys.stderr)
EOF

# Generate summary report
echo ""
echo "📊 Generation Summary:"
echo "====================="
ls -1 "$OUTPUT_DIR"/*.json | wc -l | xargs echo "Generated SBOMs:"
find "$OUTPUT_DIR" -name "*.json" -exec jq -r '.components | length' {} \; | awk '{sum+=$1} END {print "Total components: " sum}'

echo ""
echo "🎉 SBOM generation completed successfully!"
echo "Results saved to: $OUTPUT_DIR"

<!-- Modern .NET project with Native AOT -->
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net8.0</TargetFramework>
    <PublishAot>true</PublishAot>
    <InvariantGlobalization>true</InvariantGlobalization>
    <EnableTrimAnalyzer>true</EnableTrimAnalyzer>
  </PropertyGroup>

  <!-- AOT-compatible packages -->
  <ItemGroup>
    <PackageReference Include="System.Text.Json" Version="8.0.0" />
    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
  </ItemGroup>

  <!-- SBOM generation for AOT builds -->
  <Target Name="GenerateAotSbom" AfterTargets="Publish" Condition="'$(PublishAot)' == 'true'">
    <PropertyGroup>
      <AotSbomPath>$(PublishDir)sbom-aot.json</AotSbomPath>
    </PropertyGroup>

    <Exec Command="dotnet-CycloneDX &quot;$(MSBuildProjectFile)&quot; -o &quot;$(PublishDir)&quot; -fn &quot;sbom-aot.json&quot; -F Json" />

    <!-- Add trimming information -->
    <PropertyGroup>
      <TrimmedAssemblies>@(ResolvedAssembliesToPublish->'%(Filename)', ',')</TrimmedAssemblies>
    </PropertyGroup>

    <WriteLinesToFile File="$(PublishDir)trimmed-assemblies.txt" Lines="$(TrimmedAssemblies)" />
  </Target>
</Project>

# k8s-sbom-generator.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: dotnet-sbom-generator
  namespace: sbom-system
spec:
  selector:
    matchLabels:
      name: dotnet-sbom-generator
  template:
    metadata:
      labels:
        name: dotnet-sbom-generator
    spec:
      containers:
      - name: sbom-generator
        image: mcr.microsoft.com/dotnet/sdk:8.0
        command:
        - /bin/bash
        - -c
        - |
          # Install CycloneDX
          dotnet tool install --global CycloneDX
          export PATH="$PATH:/root/.dotnet/tools"

          while true; do
            # Watch for .NET applications
            kubectl get pods --all-namespaces -o json | \
            jq -r '.items[] | select(.spec.containers[].image | contains("dotnet")) | .metadata.name' | \
            while read pod; do
              echo "Generating SBOM for .NET pod: $pod"
              # Extract and analyze .NET application
            done

            sleep 3600  # Run every hour
          done
        volumeMounts:
        - name: sbom-storage
          mountPath: /sboms
        env:
        - name: KUBECONFIG
          value: /etc/kubernetes/admin.conf
      volumes:
      - name: sbom-storage
        persistentVolumeClaim:
          claimName: sbom-storage

# .github/workflows/defender-devops.yml
name: Microsoft Defender for DevOps with SBOM

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '8.0.x'

    - name: Generate SBOM
      run: |
        dotnet tool install --global CycloneDX
        dotnet-CycloneDX . -o . -fn sbom.json -F Json

    - name: Run Microsoft Security DevOps
      uses: microsoft/security-devops-action@latest
      with:
        categories: 'secrets,dependencies,IaC,SAST'
        languages: 'csharp'
        tools: 'bandit,eslint,templateanalyzer,terrascan,trivy'
      env:
        MSDO_SBOM_FILE: './sbom.json'

    - name: Upload results to Security tab
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: ${{ runner.temp }}/_msdo/results/msdo.sarif