sbom.yml

name: SBOM Generator

on:
  push:
    branches:
      - 'master'
      - 'update-workflows'

  workflow_dispatch:

permissions: read-all

jobs:
  generate-and-push-sbom:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      - name: 'Generate SBOM for Ruby dependencies'
        uses: docker://ghcr.io/cyclonedx/cdxgen:v10.0.4
        with:
          args: --spec-version 1.4 -o ./sbom-ruby.xml -t ruby .

      - name: 'Generate SBOM for Node.js dependencies'
        uses: docker://ghcr.io/cyclonedx/cdxgen:v10.0.4
        with:
          args: --spec-version 1.4 -o ./sbom-npm.xml -t npm .

      - name: "Show workspace"
        run: |
          ls -a

      - name: 'Merge frontend and backend SBOMs'
        uses: docker://cyclonedx/cyclonedx-cli
        with:
          args: merge --input-files sbom-ruby.xml sbom-npm.xml --output-file sbom.xml

      - name: 'Push merged SBOM to dependency track'
        env:
          PROJECT_NAME: skills
        run: |
          curl --verbose -s --location --request POST ${{ secrets.DEPENDENCY_TRACK_URL }} \
          --header "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
          --header "Content-Type: multipart/form-data" \
          --form "autoCreate=true" \
          --form "projectName=${PROJECT_NAME:-$GITHUB_REPOSITORY}" \
          --form "projectVersion=latest" \
          --form "bom=@sbom.xml"