sbom.yml

name: "sbom-action"
on:
  pull_request:
    branches: [main]

  push:
    branches: [main]

  release:
    types:
      - created
      - edited

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Anchore SBOM Action
        uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom.spdx

  release:
    permissions:
      # Give the default GITHUB_TOKEN write permission to commit and push the
      # added or changed files to the repository.
      contents: write

    if: startsWith(github.head_ref, 'releases/')
    runs-on: ubuntu-latest

    steps:
      - name: Anchore SBOM Release Action
        uses: anchore/sbom-action/publish-sbom@v0
        with:
          artifact-name: sbom.spdx
          sbom-artifact-match: ".*\\.spdx$"
    
      - name: Upload artifact
        uses: actions/upload-artifact@v2
        with:
          name: sbom
          path: ${{github.workspace}}/Files/sbom.spdx

      - name: Checkout
        uses: actions/checkout@v3

      - name: Download artifact
        uses: actions/download-artifact@v2
        with:
          name: sbom
          path: ${{github.workspace}}/Files
  
      - name: Commit
        uses: stefanzweifel/git-auto-commit-action@v4
        with:
          commit_message: Automated commit to add SBOM
          branch: master
          commit_options: '--no-verify --signoff'
          commit_author: SBOM Bot <actions@github.com>
          status_options: '--untracked-files=no'
          skip_dirty_check: true