sbom.yaml

name: Validate SBOMs

on:
  pull_request:
    branches:
      - 'main'

env:
  SPDX_TOOLS_VERSION: 1.1.0

jobs:
  spdx:
    name: Validate SPDX SBOM
    runs-on: ubuntu-latest

    env:
      KO_DOCKER_REPO: localhost:1338

    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version-file: 'go.mod'
          check-latest: true
      - uses: chainguard-dev/actions/setup-registry@main
      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Install SPDX Tools
        run: |
          wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
          unzip tools-java-${SPDX_TOOLS_VERSION}.zip

      - name: Generate and Validate
        run: |
          cosign download sbom $(go run ./ build) | tee spdx.json
          java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx.json

      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        if: ${{ always() }}
        with:
          name: spdx.json
          path: spdx.json

  spdx-multi-arch:
    name: Validate SPDX multi-arch SBOM
    runs-on: ubuntu-latest

    env:
      KO_DOCKER_REPO: localhost:1338

    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
        with:
          go-version-file: 'go.mod'
          check-latest: true
      - uses: chainguard-dev/actions/setup-registry@main
      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Install SPDX Tools
        run: |
          wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
          unzip tools-java-${SPDX_TOOLS_VERSION}.zip

      - name: Generate and Validate
        run: |
          img=$(go run ./ build --platform=linux/amd64,linux/arm64)
          cosign download sbom $img | tee spdx-multi-arch.json

          java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx-multi-arch.json

      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        if: ${{ always() }}
        with:
          name: spdx-multi-arch.json
          path: spdx-multi-arch.json