sbom.yml

name: SBOM Generation

on:
    push:
        branches:
            - master
    pull_request:
    release:
        types:
            - published

permissions:
    contents: read

jobs:
    sbom:
        name: Generate SBOM
        runs-on: ubuntu-latest
        permissions:
            contents: write

        steps:
            -   name: Harden Runner
                uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
                with:
                    disable-sudo: true
                    egress-policy: audit

            -   name: Checkout code
                uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

            -   name: Generate SBOM
                uses: anchore/sbom-action@deef08a0db64bfad603422135db61477b16cef56 # v0
                with:
                    format: 'spdx-json'
                    output-file: 'sbom.spdx.json'

            -   name: Upload SBOM artifact
                uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
                with:
                    name: sbom
                    path: sbom.spdx.json
                    retention-days: 90