name: SBOM Generation

on:
  workflow_dispatch:
  schedule:
    # Run weekly on Wednesday at 10 AM UTC (staggered with other scans)
    - cron: '0 10 * * 3'
  release:
    types: [published]

permissions: {}

jobs:
  sbom:
    name: Generate Software Bill of Materials
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read

    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - name: Checkout repository
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false

    - name: Generate SBOM for source code
      uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      with:
        path: .
        artifact-name: sbom-source.spdx.json
        output-file: sbom-source.spdx.json
        format: spdx-json

    - name: Generate SBOM for Python dependencies
      uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
      with:
        path: .
        artifact-name: sbom-python.cyclonedx.json
        output-file: sbom-python.cyclonedx.json
        format: cyclonedx-json

    - name: Upload SBOMs as artifacts
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: sbom-reports
        path: |
          sbom-source.spdx.json
          sbom-python.cyclonedx.json
        retention-days: 90

    - name: Display SBOM summary
      run: |
        {
          echo "## SBOM Generation Summary"
          echo ""
          echo "### Generated SBOMs"
          echo "- **Source Code SBOM**: \`sbom-source.spdx.json\` (SPDX format)"
          echo "- **Dependencies SBOM**: \`sbom-python.cyclonedx.json\` (CycloneDX format)"
          echo ""
          echo "### What is an SBOM?"
          echo "A Software Bill of Materials (SBOM) is a formal record of all components,"
          echo "libraries, and dependencies used in building software. It enables:"
          echo ""
          echo "- **Vulnerability tracking**: Know exactly what's in your software"
          echo "- **License compliance**: Verify all dependencies have compatible licenses"
          echo "- **Supply chain security**: Detect compromised dependencies"
          echo "- **Regulatory compliance**: Meet requirements (EO 14028, etc.)"
          echo ""
          echo "### Artifacts"
          echo "SBOMs are available as workflow artifacts for 90 days."
          if [ "${{ github.event_name }}" = "release" ]; then
            echo ""
            echo "SBOMs have also been attached to the release assets."
          fi
        } >> "$GITHUB_STEP_SUMMARY"