From 631c8df9d889697f81aa617cb0400759018f02c8 Mon Sep 17 00:00:00 2001
From: "Jose R. Gonzalez" <komish@flutes.dev>
Date: Thu, 6 Jun 2024 14:47:16 -0500
Subject: [PATCH] Automate the addition of SBOMs to releases

Signed-off-by: Jose R. Gonzalez <komish@flutes.dev>
---
 .github/workflows/sbom-on-release.yaml | 27 ++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/sbom-on-release.yaml

diff --git a/.github/workflows/sbom-on-release.yaml b/.github/workflows/sbom-on-release.yaml
new file mode 100644
index 00000000..80627f5c
--- /dev/null
+++ b/.github/workflows/sbom-on-release.yaml
@@ -0,0 +1,27 @@
+name: Generate and Publish SBOM on release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  generate-src-sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Parse release tag
+        run: echo RELEASE_TAG=$(echo $GITHUB_REF | cut -d '/' -f 3) | tee -a $GITHUB_ENV
+      - name: Set output filename
+        run: echo SBOM_OUTPUT_FILE="${{ github.event.repository.name }}-${{ env.RELEASE_TAG }}-sbom.spdx.json" | tee -a $GITHUB_ENV
+      - name: Generate SBOM and Attach to Release
+        # Attaching SBOM to release is inherent behavior of this action.
+        uses: anchore/sbom-action@v0
+        with:
+          # Setting path to null works around this bug:
+          # https://github.com/anchore/sbom-action/issues/389
+          path: null
+          file: go.mod
+          format: spdx-json
+          output-file: ${{ env.SBOM_OUTPUT_FILE }}
+          artifact-name: ${{ env.SBOM_OUTPUT_FILE }}