aura/.github/workflows/sbom.yml at e2b06013ab63780d3ecd4c91474761af24f60f0b · Rfluid/aura · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
name: SBOM

on:
    push:
        branches: [main]
    pull_request:
        branches: [main, develop]
    schedule:
        - cron: "0 6 * * 1"
    workflow_dispatch:

permissions:
    contents: read

jobs:
    generate-sbom:
        name: Generate SBOM (CycloneDX for Rust)
        runs-on: ubuntu-latest

        steps:
            - name: Checkout repository
              uses: actions/checkout@v6

            - name: Install Syft
              uses: anchore/sbom-action/download-syft@v0

            - name: Generate SBOM (JSON)
              run: syft dir:. -o cyclonedx-json=sbom.json

            - name: Generate SBOM (XML)
              run: syft dir:. -o cyclonedx-xml=sbom.xml

            - name: Upload SBOM artifacts
              uses: actions/upload-artifact@v7
              with:
                  name: sbom
                  path: |
                      sbom.json
                      sbom.xml