sbom.yaml

name: Validate SBOMs

on:
  pull_request:
    branches:
      - 'main'

env:
  SPDX_TOOLS_VERSION: 1.1.0

jobs:
  spdx:
    name: Validate SPDX SBOM
    runs-on: ubuntu-latest

    env:
      KO_DOCKER_REPO: localhost:1338

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: 'go.mod'
          check-latest: true
      - uses: chainguard-dev/actions/setup-registry@main
      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Install SPDX Tools
        run: |
          wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
          unzip tools-java-${SPDX_TOOLS_VERSION}.zip

      - name: Generate and Validate
        run: |
          cosign download sbom $(go run ./ build) | tee spdx.json
          java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx.json

      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        if: ${{ always() }}
        with:
          name: spdx.json
          path: spdx.json

  spdx-multi-arch:
    name: Validate SPDX multi-arch SBOM
    runs-on: ubuntu-latest

    env:
      KO_DOCKER_REPO: localhost:1338

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
        with:
          go-version-file: 'go.mod'
          check-latest: true
      - uses: chainguard-dev/actions/setup-registry@main
      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Install SPDX Tools
        run: |
          wget https://github.com/spdx/tools-java/releases/download/v${SPDX_TOOLS_VERSION}/tools-java-${SPDX_TOOLS_VERSION}.zip
          unzip tools-java-${SPDX_TOOLS_VERSION}.zip

      - name: Generate and Validate
        run: |
          img=$(go run ./ build --platform=linux/amd64,linux/arm64)
          cosign download sbom $img | tee spdx-multi-arch.json

          java -jar ./tools-java-${SPDX_TOOLS_VERSION}-jar-with-dependencies.jar Verify spdx-multi-arch.json

      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        if: ${{ always() }}
        with:
          name: spdx-multi-arch.json
          path: spdx-multi-arch.json