sbom.yaml

name: SBOM

on:
  push:
    branches:
      - main
      - autoupdate/strict
      - autoupdate/moonray
      - 'release-[0-9]+.[0-9]+'
      - 'autoupdate/release-[0-9]+.[0-9]+-strict'
      - 'autoupdate/sync/**'
  pull_request:

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit
      - name: Checking out repo
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: |
          pip3 install -r ./build-scripts/hack/requirements.txt
      - name: Build SBOM
        run: |
          ./build-scripts/hack/generate-sbom.py sbom.tar.gz
          tar xvzf sbom.tar.gz
      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom