From 40f758575e7422caf634377753b9b7bba6c72ddb Mon Sep 17 00:00:00 2001
From: Open Source Santander AI <opensource@gruposantander.com>
Date: Fri, 10 Jul 2026 10:33:44 +0200
Subject: [PATCH] ci: attach SBOM (SPDX + CycloneDX) to every release

Same SHA-pinned sbom.yml already merged and verified in gen-fraud-graph:
on each published release it generates the SBOM with syft in both standard
formats and attaches them as release assets. Top-level permissions none,
contents: write only at job level.
---
 .github/workflows/sbom.yml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/sbom.yml

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
new file mode 100644
index 0000000..5739fe5
--- /dev/null
+++ b/.github/workflows/sbom.yml
@@ -0,0 +1,36 @@
+# Generates a Software Bill of Materials for each published release and
+# attaches it as release assets in both standard formats (SPDX + CycloneDX).
+# Manual runs (workflow_dispatch) upload the SBOMs as workflow artifacts only.
+name: SBOM
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  sbom:
+    name: Generate and attach SBOM
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # upload release assets
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Generate SPDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          format: spdx-json
+          output-file: ${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
+          artifact-name: ${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
+          upload-release-assets: ${{ github.event_name == 'release' }}
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          format: cyclonedx-json
+          output-file: ${{ github.event.repository.name }}-${{ github.ref_name }}.cdx.json
+          artifact-name: ${{ github.event.repository.name }}-${{ github.ref_name }}.cdx.json
+          upload-release-assets: ${{ github.event_name == 'release' }}