#29944 creating sbom-generation action.

.github/actions/legacy-release/sbom-generator/action.yml

@@ -0,0 +1,62 @@
+name: 'DotCMS SBOM Generator'
+description: 'Generates SBOM for a specified version of dotCMS'
+inputs:
+  dotcms_version:
+    description: 'The dotCMS version (vYY.MM.DD)'
+    required: true
+  github_token:
+    description: 'GitHub token for pushing changes'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout core-test-results repository
+      uses: actions/checkout@v4
+      with:
+        repository: dotCMS/core-test-results
+        token: ${{ inputs.github_token }}
+        path: core-test-results
+
+    - name: Set dotCMS version
+      shell: bash
+      run: |
+        formatted_tag=$(echo "${{ inputs.dotcms_version }}" | sed -e 's/^dotcms-cli-//' -e 's/^v//')
+        echo "DOTCMS_VERSION=$formatted_tag" >> $GITHUB_ENV
+
+    - name: Pull and run dotCMS Docker image
+      shell: bash
+      run: |
+        docker pull dotcms/dotcms:${{ env.DOTCMS_VERSION }}
+        docker run -d -p 8082:8082 dotcms/dotcms:${{ env.DOTCMS_VERSION }}
+
+    - name: Install pipx
+      shell: bash
+      run: pip install pipx
+
+    - name: Scan Docker Image with Syft
+      shell: bash
+      run: |
+        pipx run anchore_syft dotcms/dotcms:${{ env.DOTCMS_VERSION }} -o cyclonedx-xml > core-test-results/sbom/cyclonedx.json
+
+    - name: Rename SBOM file with dotCMS version
+      shell: bash
+      run: |
+        mkdir -p core-test-results/sbom
+        mv core-test-results/sbom/cyclonedx.json core-test-results/sbom/dotcms-${{ env.DOTCMS_VERSION }}.json
+
+    - name: Configure Git
+      shell: bash
+      run: |
+        git config --global user.email "[email protected]"
+        git config --global user.name "Github Actions"
+
+    - name: Commit and push results to core-test-results repository
+      shell: bash
+      run: |
+        cd core-test-results
+        git add sbom/dotcms-${{ env.DOTCMS_VERSION }}.json
+        git commit -m "Add SBOM for dotCMS version ${{ env.DOTCMS_VERSION }}" || echo "No changes to commit"
+        git push origin main
+      env:
+        GITHUB_TOKEN: ${{ inputs.github_token }}