sbom.yml

---
name: SBOM Generator

on:
  push:
    branches:
      - 'master'

  workflow_dispatch:

permissions: read-all

jobs:
  generate-and-push-sbom:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Install cdxgen
        run: |
          npm install -g @cyclonedx/cdxgen

      - name: 'Generate SBOM for ruby dependencies'
        run: |
          cdxgen -o ./sbom-ruby.xml -t ruby .

      - name: 'Push SBOM to dependency track'
        env:
          PROJECT_NAME: decidim-zuerich
        run: |
          curl --verbose -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
          --header "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
          --header "Content-Type: multipart/form-data" \
          --form "autoCreate=true" \
          --form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
          --form "projectVersion=latest" \
          --form "bom=@sbom-ruby.xml"
  ...