From 631c8df9d889697f81aa617cb0400759018f02c8 Mon Sep 17 00:00:00 2001 From: "Jose R. Gonzalez" Date: Thu, 6 Jun 2024 14:47:16 -0500 Subject: [PATCH] Automate the addition of SBOMs to releases Signed-off-by: Jose R. Gonzalez --- .github/workflows/sbom-on-release.yaml | 27 ++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/sbom-on-release.yaml diff --git a/.github/workflows/sbom-on-release.yaml b/.github/workflows/sbom-on-release.yaml new file mode 100644 index 00000000..80627f5c --- /dev/null +++ b/.github/workflows/sbom-on-release.yaml @@ -0,0 +1,27 @@ +name: Generate and Publish SBOM on release + +on: + release: + types: [published] + +jobs: + generate-src-sbom: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + - name: Parse release tag + run: echo RELEASE_TAG=$(echo $GITHUB_REF | cut -d '/' -f 3) | tee -a $GITHUB_ENV + - name: Set output filename + run: echo SBOM_OUTPUT_FILE="${{ github.event.repository.name }}-${{ env.RELEASE_TAG }}-sbom.spdx.json" | tee -a $GITHUB_ENV + - name: Generate SBOM and Attach to Release + # Attaching SBOM to release is inherent behavior of this action. + uses: anchore/sbom-action@v0 + with: + # Setting path to null works around this bug: + # https://github.com/anchore/sbom-action/issues/389 + path: null + file: go.mod + format: spdx-json + output-file: ${{ env.SBOM_OUTPUT_FILE }} + artifact-name: ${{ env.SBOM_OUTPUT_FILE }}