sbom.yml

name: SBOM upload and commit

on:
  workflow_dispatch:
  push:
    branches: ["master"]

env:
  DeleteManifestDirIfPresent: 'true'
  
jobs:
  SBOM-upload:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write
      contents: write
      actions: write
      statuses: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v3
      
    - name: Generate SBOM
      run: |
        curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
        chmod +x $RUNNER_TEMP/sbom-tool
        $RUNNER_TEMP/sbom-tool generate -b . -bc . -pn git_command -pv 1.0.0 -ps gon1942
        
    - name: Upload Artifact
      uses: actions/upload-artifact@v3
      with:
        name: sbom
        path: _manifest/spdx_2.2

    - name: Commit and push SBOM to repository
      run: |
        git config --global user.name 'GitHub Actions'
        git config --global user.email 'actions@github.com'
        git add _manifest/spdx_2.2/*
        git commit -m "Add generated SBOM"
        git push
      
    - name: SBOM upload
      uses: advanced-security/spdx-dependency-submission-action@v0.0.1
      with:
        filePath: "./_manifest/spdx_2.2/"