ci: Fix SBOM path (#408)

Signed-off-by: André Silva <[email protected]>
Co-authored-by: Michael Beemer <[email protected]>

Author: askpt

.github/workflows/release.yml

@@ -19,8 +19,8 @@ jobs:
         with:
           token: ${{secrets.RELEASE_PLEASE_ACTION_TOKEN}}
     outputs:
-      release_created: ${{ fromJSON(steps.release.outputs.paths_released)[0] != null }} # if we have a single release path, do the release
-      # release_tag_name: ${{ steps.release.outputs.release_tag_name }}
+      all: ${{ toJSON(steps.release.outputs) }}
+      releases_created: ${{ steps.release.outputs.releases_created }}
       paths_released: ${{ steps.release.outputs.paths_released }}
 
   release:
@@ -32,10 +32,12 @@ jobs:
       contents: write # upload sbom to a release
       attestations: write
       packages: read # for internal nuget reading
-    if: ${{ needs.release-package.outputs.release_created }}
+    if: ${{ fromJSON(needs.release-package.outputs.releases_created || false) }}
     strategy:
       matrix:
         release: ${{ fromJSON(needs.release-package.outputs.paths_released) }}
+    env:
+      TAG_NAME: ${{ fromJSON(needs.release-package.outputs.all)[format('{0}--tag_name', matrix.release)] }}
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
@@ -90,9 +92,7 @@ jobs:
           subject-path: "${{ matrix.release }}/**/*.nupkg"
           sbom-path: bom.json
 
-      # TODO: We need to look into this link and fix the tag_name https://github.com/googleapis/release-please-action?tab=readme-ov-file#outputs
-      # Because we are using a multiple release path, we need to use the <path>--tag_name from the release-package job
-      # - name: Attach SBOM to artifact
-      #   env:
-      #     GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-      #   run: gh release upload ${{ needs.release-package.outputs.release_tag_name }} bom.json
+      - name: Attach SBOM to artifact
+        env:
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+        run: gh release upload ${{ env.TAG_NAME }} bom.json