openfga-laravel/.github/workflows/security-sbom.yml at 3d21a0a88e05422d441a0b9cdacefc0ee13eaabb · evansims/openfga-laravel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: "Security: SBOM"

on:
  push:
    branches: [main]
    paths:
      - composer.json
      - composer.lock
  pull_request:
    branches: [main]
    paths:
      - composer.json
      - composer.lock
  release:
    types: [created]
  workflow_dispatch:

jobs:
  build:
    name: "Generate Report"
    runs-on: ubuntu-latest

    permissions:
      contents: write # Needed to upload artifacts to releases
      packages: write # Needed for SBOM upload to GitHub packages

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup PHP
        uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # 2.35.4
        with:
          php-version: "8.3"
          coverage: none
          tools: composer:v2

      - name: Install dependencies
        run: composer install --no-dev --no-interaction --prefer-dist

      - name: Install SBOM composer plugin
        run: |-
          composer global config --no-plugins allow-plugins.cyclonedx/cyclonedx-php-composer true
          composer global require cyclonedx/cyclonedx-php-composer

      - name: Generate SBOM
        run: composer cyclonedx:make-sbom --output-format=JSON --output-file=sbom.cyclonedx.json

      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sbom
          path: sbom.cyclonedx.json
          retention-days: 30

      # Only upload SBOM to releases when a release is created
      - name: Upload SBOM to Release
        if: github.event_name == 'release'
        uses: svenstaro/upload-release-action@81c65b7cd4de9b2570615ce3aad67a41de5b1a13 # 2.11.2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: sbom.cyclonedx.json
          asset_name: openfga-php-sbom.cyclonedx.json
          tag: ${{ github.ref }}
          overwrite: true