bom.yml

name: Software bill of materials (BOM)

on:
  push:
    branches: [main]

  workflow_dispatch:

jobs:
  bom:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v4

      - name: Read .nvmrc
        run: echo "NODE_VERSION=$(cat .nvmrc)" >> $GITHUB_OUTPUT
        id: nvm

      - name: Use Node.js ${{ steps.nvm.outputs.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ steps.nvm.outputs.NODE_VERSION }}
          cache: "npm"

      - name: Install @cyclonedx/cyclonedx-npm
        run: npm install @cyclonedx/cyclonedx-npm --no-save

      - name: Generate BOM
        run: npm exec -- cyclonedx-npm --output-format XML --output-file bom.xml

      - name: Push BOM to Dependency Track
        env:
          PROJECT_NAME: puzzle-shell
        run: |
          curl --verbose -s --location --request POST ${{vars.DEPENDENCY_TRACK_URL}}/api/v1/bom \
               --header "X-Api-Key: ${{secrets.DEPENDENCY_TRACK_API_KEY}}" \
               --header "Content-Type: multipart/form-data" \
               --form "autoCreate=true" \
               --form "projectName=$PROJECT_NAME" \
               --form "projectVersion=latest" \
               --form "bom=@bom.xml"