.github/workflows/generate-maven-sbom.yaml

name: Generate Maven SBOM

on:
  push:
    tags:
      - "v**" # Triggers when someone pushes a tag that starts with 'v'

  workflow_dispatch:
    # The custom 'Version' input field allows running the workflow for older git
    # refs, where this workflow file did not exist yet. This would not be
    # possible with the builtin "Use workflow from" input field.
    inputs:
      version:
        description: "Version"
        default: "master"
        required: true

env:
  JAVA_VERSION: '17'
  JAVA_DISTRO: 'temurin'
  PLUGIN_VERSION: '2.9.1'
  SBOM_TYPE: 'makeAggregateBom'
  PROJECT_VERSION: "${{ github.event_name == 'release' && github.event.release.tag_name || github.event.inputs.version }}"

permissions:
  contents: read

jobs:
  generate-sbom:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout repository at '${{ env.PROJECT_VERSION }}'
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
          ref: ${{ env.PROJECT_VERSION }}
          persist-credentials: false

      - name: Setup Java SDK
        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRO }}

      - name: Generate
        run: |
          mvn org.cyclonedx:cyclonedx-maven-plugin:${PLUGIN_VERSION}:${SBOM_TYPE} \
              -DoutputFormat=json \
              -DoutputDirectory=target \
              -DoutputName=cyclonedx


      - name: Upload
        uses: eclipse-csi/workflows/upload-sbom@20e3c63807b2bd61b7f1a9f438e5ce588c054efc # main
        with:
          sbom-file: target/cyclonedx.json
          product-name: 'JGit'
          product-version: ${{ env.PROJECT_VERSION }}