diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml new file mode 100644 index 0000000..e8663ae --- /dev/null +++ b/.github/workflows/production.yml @@ -0,0 +1,34 @@ +name: Generate and Publish SBOM + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +on: + push: + branches: + - "main" + + +permissions: + id-token: write + contents: read # This is required for actions/checkout@v2 + +jobs: + generate-and-publish-sbom: + runs-on: ubuntu-latest + + steps: + - name: Checkout source code + uses: actions/checkout@v3 + + # Generate and transmita copy of our generated SBOM to Manifest + - name: Transmit generated SBOM to Manifest + uses: manifest-cyber/manifest-github-action@main + id: transmit + with: + # Generate an API key at https://app.manifestcyber.com/organization + # Store the key as a secret in Github, and reference it below + # Do not share this key - this allows the holder to upload SBOM's to Manifest on your behalf + apiKey: ${{ secrets.MANIFEST_API_KEY }} +