sbom.yml

name: SBOM
on:
  release:
    types: [published]
  workflow_dispatch:
          
permissions: read-all

jobs:
  sbom:
    runs-on: ubuntu-latest
    env:
      NPM_CONFIG_UNSAFE_PERM: true
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - run: npm install -g npm@latest

      - name: Bootstrap
        run: npm ci

      - name: Generate SBOM for the whole repository
        run: |
          npm sbom --sbom-format=spdx --legacy-peer-deps > sbom.spdx

      - name: Generate SBOM for the API package
        run: |
          npm sbom --sbom-format=spdx --legacy-peer-deps --workspace api > api.spdx

      - name: Generate SBOMs for packages 
        run: |
          for dir in $(find packages -mindepth 1 -maxdepth 1 -type d)
          do
            dir_name=$(basename "$dir")
            echo "Generating SBOM for $dir_name"
            npm sbom --sbom-format=spdx --legacy-peer-deps --workspace ${dir} > "${dir_name}.spdx"
          done

      - name: Generate SBOMs for experimental packages 
        run: |
          for dir in $(find experimental/packages -mindepth 1 -maxdepth 1 -type d)
          do
            dir_name=$(basename "$dir")
            echo "Generating SBOM for $dir_name"
            npm sbom --sbom-format=spdx --legacy-peer-deps --workspace ${dir} > "${dir_name}.spdx"
          done

      - name: Zip all SBOM files
        run: |
          zip sbom.zip *.spdx 

      - uses: actions/upload-artifact@v4
        with: 
          path: ./sbom.zip
          name: "SBOM"