Skip to content

ci: attach SBOM (SPDX + CycloneDX) to every release #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
opensource-SantanderAI merged 1 commit into from
Jul 10, 2026
+36 −0
Merged

ci: attach SBOM (SPDX + CycloneDX) to every release #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 36 additions & 0 deletions .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
# Generates a Software Bill of Materials for each published release and
# attaches it as release assets in both standard formats (SPDX + CycloneDX).
# Manual runs (workflow_dispatch) upload the SBOMs as workflow artifacts only.
name: SBOM

on:
release:
types: [published]
workflow_dispatch:

permissions: {}

jobs:
sbom:
name: Generate and attach SBOM
runs-on: ubuntu-latest
permissions:
contents: write # upload release assets
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Generate SPDX SBOM
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
format: spdx-json
output-file: ${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
artifact-name: ${{ github.event.repository.name }}-${{ github.ref_name }}.spdx.json
upload-release-assets: ${{ github.event_name == 'release' }}
- name: Generate CycloneDX SBOM
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
format: cyclonedx-json
output-file: ${{ github.event.repository.name }}-${{ github.ref_name }}.cdx.json
artifact-name: ${{ github.event.repository.name }}-${{ github.ref_name }}.cdx.json
upload-release-assets: ${{ github.event_name == 'release' }}
Loading