Anthias/.github/workflows/sbom.yaml at 29ae072514c062fd241922e93492fc93f8bb482d · Screenly/Anthias · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Build SBOMs

on:
  push:
    branches:
      - master
    paths:
      - 'package-lock.json'
      - 'uv.lock'

jobs:
  run-tests:
    uses: ./.github/workflows/docker-test.yaml

  js-sbom:
    needs: run-tests
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      contents: read
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Build and upload SBOM
        uses: sbomify/github-action@master
        env:
          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
          COMPONENT_ID: 'LCkvzm8qaL'
          SBOM_FILE: 'package-lock.json'
          AUGMENT: true
          UPLOAD: true
          OUTPUT_FILE: js.cdx.json

      - name: Attest
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: '${{ github.workspace }}/*.cdx.json'

  python-sbom:
    needs: run-tests
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      contents: read
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Build and upload SBOM
        uses: sbomify/github-action@master
        env:
          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
          COMPONENT_ID: 'Vhc4zm8pdV'
          SBOM_FILE: 'uv.lock'
          AUGMENT: true
          UPLOAD: true
          OUTPUT_FILE: python.cdx.json

      - name: Attest
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: '${{ github.workspace }}/*.cdx.json'