sbom.yaml

name: Generate SBOM

on:
  pull_request:
    types: [ opened, synchronize, reopened ]
  workflow_dispatch:

jobs:
  sbom:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the code
        uses: actions/checkout@v4

      - name: Set up PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'

      - name: Install snapd
        run: sudo apt install snapd

      - name: Install OSV-Scanner
        run : sudo snap install osv-scanner

      - name: Allow SBOM Plugin
        run: composer config --no-plugins allow-plugins.cyclonedx/cyclonedx-php-composer true

      - name: Install SBOM Plugin
        run: composer require cyclonedx/cyclonedx-php-composer

      - name: CREATE SBOM
        run: composer CycloneDX:make-sbom --output-file=sbom.json --output-format=json

      - name: Upload SBOM as an artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

      - name: Run OSV-Scanner
        run: osv-scanner --sbom=sbom.json