Merge pull request #2 from manifest-cyber/MFST-44

MFST-44: Eating our dogfood and drinking our champagne!

.github/workflows/production.yml

@@ -0,0 +1,34 @@
+name: Generate and Publish SBOM
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - "main"
+
+
+permissions:
+  id-token: write
+  contents: read # This is required for actions/checkout@v2
+
+jobs:
+  generate-and-publish-sbom:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v3
+
+      # Generate and transmita copy of our generated SBOM to Manifest
+      - name: Transmit generated SBOM to Manifest
+        uses: manifest-cyber/manifest-github-action@main
+        id: transmit
+        with:
+          # Generate an API key at https://app.manifestcyber.com/organization
+          # Store the key as a secret in Github, and reference it below
+          # Do not share this key - this allows the holder to upload SBOM's to Manifest on your behalf
+          apiKey: ${{ secrets.MANIFEST_API_KEY }}
+