sbom.yaml

name: Generate SBOM

on:
  pull_request:
    types: [ opened, synchronize, reopened ]
  workflow_dispatch:

jobs:
  sbom:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the code
        uses: actions/checkout@v4

      - name: Set up PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'

      - name: Install Composer dependencies
        run: composer install --no-progress --no-suggest --prefer-dist --no-interaction

      - name: Allow SBOM Plugin
        run: composer config --no-plugins allow-plugins.cyclonedx/cyclonedx-php-composer true

      - name: Install SBOM Plugin
        run: composer require cyclonedx/cyclonedx-php-composer

      - name: CREATE SBOM
        run: CycloneDX:make-sbom --output-file=sbom.json --output-format=json

      - name: Upload SBOM as an artifact
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.json