Update GitHub Actions workflow for SBOM generation and Snyk versioning (#8952)

- Set SNYK_VERSION and CYCLONEDX_VERSION as environment variables for easier updates.
- Modify Snyk installation to use the defined SNYK_VERSION.
- Adjust working directories for iOS and Android SBOM generation.
- Enhance error handling for CycloneDX CLI download and SBOM file checks.
- Ensure required SBOM files are present before consolidation.

Author: angeloskyratzakos

.github/workflows/github-release.yml

@@ -13,6 +13,8 @@ on:
 
 env:
   RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+  SNYK_VERSION: "1.1297.2"
+  CYCLONEDX_VERSION: "v0.27.2"
 
 jobs:
   test:
@@ -57,14 +59,14 @@ jobs:
           name: Mattermost-unsigned.ipa
 
       - name: ci/install-snyk
-        run: npm install -g snyk@1.1296.1
+        run: npm install -g snyk@${{ env.SNYK_VERSION }}
 
       - name: ci/generate-ios-sbom
         env:
           SNYK_TOKEN: "${{ secrets.SNYK_TOKEN }}"
         run: |
-          cd ios/
           snyk sbom --format=cyclonedx1.6+json --json-file-output=../sbom-ios.json --all-projects
+        working-directory: ./ios
         shell: bash
 
       - name: ci/upload-ios-sbom
@@ -100,14 +102,14 @@ jobs:
           name: Mattermost-unsigned.apk
 
       - name: ci/install-snyk
-        run: npm install -g snyk@1.1296.1
+        run: npm install -g snyk@${{ env.SNYK_VERSION }}
 
       - name: ci/generate-android-sbom
         env:
           SNYK_TOKEN: "${{ secrets.SNYK_TOKEN }}"
         run: |
-          cd android/
-          snyk sbom --format=cyclonedx1.6+json --all-projects --json-file-output=../sbom-android.json
+          snyk sbom --format=cyclonedx1.6+json --all-projects --json-file-output=sbom-android.json
+        working-directory: ./android
         shell: bash
 
       - name: ci/upload-android-sbom
@@ -128,26 +130,54 @@ jobs:
       - name: ci/download-sboms
         uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47c8a # v4.2.1
         with:
+          pattern: sbom-*.json
           path: ${{ github.workspace }}
-          pattern: |
-            sbom-ios.json
-            sbom-android.json
           merge-multiple: true
 
       - name: ci/install-snyk
-        run: npm install -g snyk@1.1296.1
+        run: npm install -g snyk@${{ env.SNYK_VERSION }}
 
       - name: ci/setup-cyclonedx-cli
         run: |
-          curl -sSfL https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.27.2/cyclonedx-linux-x64 -o cyclonedx
+          set -e
+          CYCLONEDX_BINARY="cyclonedx-linux-x64"
+          CYCLONEDX_URL="https://github.com/CycloneDX/cyclonedx-cli/releases/download/${{ env.CYCLONEDX_VERSION }}/${CYCLONEDX_BINARY}"
+
+          # Download with better error handling and retry
+          echo "Downloading CycloneDX CLI ${{ env.CYCLONEDX_VERSION }}..."
+          curl -sSfL --retry 3 --retry-delay 5 "${CYCLONEDX_URL}" -o cyclonedx
+
+          # Verify the binary is executable and not corrupted
+          if [ ! -s cyclonedx ]; then
+            echo "Error: Downloaded file is empty or corrupted"
+            exit 1
+          fi
+
+          # Make executable and move to PATH
           chmod +x cyclonedx
           sudo mv cyclonedx /usr/local/bin/
 
+          # Verify installation
+          cyclonedx --version
+
       - name: ci/generate-consolidated-sbom
         env:
           SNYK_TOKEN: "${{ secrets.SNYK_TOKEN }}"
           SBOM_FILENAME: "sbom-${{ github.event.repository.name }}-${{ env.RELEASE_TAG }}.json"
         run: |
+          # Check if required SBOM files are available
+          if [ ! -f "sbom-android.json" ]; then
+            echo "Error: sbom-android.json not found. Android SBOM generation may have failed."
+            exit 1
+          fi
+
+          if [ ! -f "sbom-ios.json" ]; then
+            echo "Error: sbom-ios.json not found. iOS SBOM generation may have failed."
+            exit 1
+          fi
+
+          echo "All required SBOM files are available. Proceeding with consolidation..."
+
           # Generate top-level SBOM
           snyk sbom --format=cyclonedx1.6+json --json-file-output=sbom-top-level.json