auto-bayesian/.github/workflows/sbom.yml at main · SantanderAI/auto-bayesian · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# Generates a Software Bill of Materials for each published release, stamps
# Santander Group as document creator, signs a build provenance attestation
# (Sigstore, verifiable with `gh attestation verify`) and attaches both
# standard formats (SPDX + CycloneDX) as release assets.
# Manual runs (workflow_dispatch) upload the SBOMs as workflow artifacts only.
name: SBOM

on:
  release:
    types: [published]
  workflow_dispatch:

permissions: {}

env:
  BASE: ${{ github.event.repository.name }}-${{ github.ref_name }}

jobs:
  sbom:
    name: Generate, attest and attach SBOM
    runs-on: ubuntu-latest
    permissions:
      contents: write      # upload release assets
      id-token: write      # sign the attestation (Sigstore)
      attestations: write  # store the attestation
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          persist-credentials: false
      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
        with:
          format: spdx-json
          output-file: ${{ env.BASE }}.spdx.json
          upload-artifact: false
          upload-release-assets: false
      - name: Generate CycloneDX SBOM
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
        with:
          format: cyclonedx-json
          output-file: ${{ env.BASE }}.cdx.json
          upload-artifact: false
          upload-release-assets: false
      - name: Stamp Santander Group as document creator
        run: |
          jq '.creationInfo.creators += ["Organization: Santander Group"]' \
            "$BASE.spdx.json" > tmp.json && mv tmp.json "$BASE.spdx.json"
          jq '.metadata.authors = [{"name": "Open Source Santander AI", "email": "opensource@gruposantander.com"}]' \
            "$BASE.cdx.json" > tmp.json && mv tmp.json "$BASE.cdx.json"
      - name: Attest SBOM build provenance
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
        with:
          subject-path: |
            ${{ env.BASE }}.spdx.json
            ${{ env.BASE }}.cdx.json
      - name: Upload SBOMs as workflow artifacts (manual runs)
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: sboms
          path: |
            ${{ env.BASE }}.spdx.json
            ${{ env.BASE }}.cdx.json
      - name: Attach SBOMs to the release
        if: github.event_name == 'release'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ github.event.release.tag_name }}" \
            "$BASE.spdx.json" "$BASE.cdx.json" --clobber