Generate and upload SBOM (#12)

* Generate and upload SBOM

* Split off SBOM generation

.github/workflows/publish.yaml

@@ -6,10 +6,10 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
-    uses: ./.github/workflows/build.yaml
+  sbom:
+    uses: ./.github/workflows/sbom.yaml
   publish:
-    needs: build
+    needs: sbom
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:

.github/workflows/sbom.yaml

@@ -0,0 +1,32 @@
+name: Generate SBOM
+on:
+  workflow_call:
+
+jobs:
+  build:
+    uses: ./.github/workflows/build.yaml
+  sbom:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Install Syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+      - name: Set tag
+        run: |
+          version=$(yq '(.version|split("-"))[0]' rockcraft.yaml)
+          base=$(yq '(.base|split(":"))[1]' rockcraft.yaml)
+          echo "tag=${version}-${base}_edge" >> "$GITHUB_ENV"
+      - uses: actions/download-artifact@v3
+        with:
+          name: postgresql-rock
+      - name: Create SBOM
+        run: syft charmed-postgresql_${{env.tag}}_amd64.rock -o spdx-json=charmed-postgresql_${{env.tag}}_amd64.rock.spdx.json
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v3
+        with:
+          path: "charmed-postgresql_${{env.tag}}_amd64.rock.spdx.json"
+          name: charmed-postgresql_${{env.tag}}_amd64.rock.spdx.json