name: SBOM Generation
on:
  release:
    types: [published]

permissions:
  contents: write

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Generate SBOM (SPDX)
        uses: anchore/sbom-action@v0
        with:
          artifact-name: career-ops-sbom.spdx.json
          format: spdx-json
          output-file: career-ops-sbom.spdx.json

      - name: Upload SBOM to release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload ${{ github.event.release.tag_name }} career-ops-sbom.spdx.json