sbom_manifest_action.yml

name: Generate the CycloneDX BOM for a Rust crate

on: [workflow_dispatch, workflow_call]

jobs:
  Generate-BOM-Manifest:
    name: Run cargo-cyclonedx and generate BOM files [both JSON and XML]
    runs-on: ubuntu-20.04
    steps:
      - run: |
          sudo apt -o Acquire::Retries=3 update
          sudo apt -o Acquire::Retries=3 install -y musl-tools

      - uses: actions/checkout@v3

      - name: Install Rust tool chain
        uses: dtolnay/rust-toolchain@master
        with:
          target: x86_64-unknown-linux-musl
          toolchain: nightly-2023-01-02
          override: true

      - name: Install cargo-cyclonedx
        run: cargo install cargo-cyclonedx

      - name: Run cycloneDX and get JSON output
        run: cargo cyclonedx --all --format=json

      - name: Run cycloneDX and get XML output
        run: cargo cyclonedx --all --format=xml

      - name: Upload the JSON BOM file
        uses: actions/upload-artifact@v3
        with:
          name: SBOM.json
          path: bom.json

      - name: Upload the XML BOM file
        uses: actions/upload-artifact@v3
        with:
          name: SBOM.xml
          path: bom.xml