sbom.yml

name: SBOM 

on:
  push:
    branches:
      - 'master'

  workflow_dispatch:

jobs:
  generate-and-push-sbom:
    runs-on: ubuntu-latest

    steps:
      - name: 'Checkout'
        uses: actions/checkout@v4

      - name: 'Generate SBOM for Ruby dependencies'
        uses: docker://ghcr.io/cyclonedx/cdxgen:v10.0.4
        with:
          args: --spec-version 1.4 -p -o bom-ruby.json -t ruby .

      - name: 'Generate SBOM for Node.js dependencies'
        uses: docker://ghcr.io/cyclonedx/cdxgen:v10.0.4
        with:
          args: --spec-version 1.4 -p -o bom-npm.json -t js .

      - name: 'Merge Ruby and Node.js SBOMs'
        uses: docker://cyclonedx/cyclonedx-cli:0.25.0
        with:
          args: merge --input-format json --input-files bom-ruby.json bom-npm.json --output-format json --output-file bom.json

      - name: 'Push merged SBOM to dependency track'
        env:
          PROJECT_NAME: skills
        run: |
          curl -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
          --header "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
          --header "Content-Type: multipart/form-data" \
          --form "autoCreate=true" \
          --form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
          --form "projectVersion=latest" \
          --form "bom=@bom.json"