.github/workflows/sbom.yml

name: SBOM — CycloneDX via Syft

on:
  push:
    branches: [ main ]
    tags:
      - 'v*'
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: write
  packages: read
  id-token: write

jobs:
  sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Generate SBOM with Syft (CycloneDX)
        uses: anchore/sbom-action@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0.17.0
        with:
          output-file: sbom.cdx.json
          format: cyclonedx-json
          artifact-name: sbom.cdx.json
          upload-artifact: true
          upload-release-assets: true

      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom-cyclonedx
          path: sbom.cdx.json
          retention-days: 90