.github/workflows/sbom-syft.yml

# .github/workflows/sbom-syft.yml
# SZL Holdings — SBOM generation via Syft (Anchore lift)
# Doctrine v11 LOCKED 749/14/163. SLSA L1 honest.
# Signed-off-by: Yachay <yachay@szlholdings.ai>
# Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>
name: SBOM — Syft (Anchore)
on:
  push:
    branches: [main]
  workflow_dispatch:
permissions:
  contents: read
  id-token: write
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Install Syft
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin v1.5.0
      - name: Generate SPDX SBOM
        run: |
          syft . -o spdx-json > sbom.spdx.json
          echo "SBOM generated: $(wc -l < sbom.spdx.json) lines"
      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom-spdx
          path: sbom.spdx.json
          retention-days: 90