sbom.yml

---
name: Generate SBOMs

on:
  release:
    types:
      - published
jobs:
  sbom:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4

      - name: Build Golang SBOM
        uses: sbomify/github-action@master
        env:
          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
          COMPONENT_ID: 'LCJffn8vKX'
          LOCK_FILE: 'go.mod'
          OVERRIDE_NAME: true
          SBOM_VERSION: ${{ github.ref_name }}
          AUGMENT: true
          ENRICH: true
          OUTPUT_FILE: 'helix-golang.cdx.json'

      - name: Build JavaScript SBOM
        uses: sbomify/github-action@master
        env:
          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
          COMPONENT_ID: 'Z_wMfn8vWv'
          LOCK_FILE: 'frontend/yarn.lock'
          OVERRIDE_NAME: true
          SBOM_VERSION: ${{ github.ref_name }}
          AUGMENT: true
          ENRICH: true
          OUTPUT_FILE: 'helix-js.cdx.json'

      - name: Attest
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: '${{ github.workspace }}/*.cdx.json'