From 6a5e7f33899ed1e18e9191cd1ecaa52f68643ddb Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Mon, 8 Jun 2026 17:44:15 +0800
Subject: [PATCH] feat(ci): add SBOM generation to release workflow

Syft generates CycloneDX and SPDX SBOMs from the amd64 production
image and uploads both to the GitHub Release.
---
 .github/workflows/release.yml | 48 +++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ec22f59a..9a6387e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -309,6 +309,54 @@ jobs:
         with:
           sarif_file: "trivy-results.sarif"
 
+  sbom:
+    name: Generate SBOM
+    needs: [release, docker]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: read
+    steps:
+      - name: Download amd64 digest
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: digests-linux-amd64
+          path: /tmp/digests
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
+      - name: Get digest
+        id: digest
+        run: |
+          sha=$(ls /tmp/digests | head -1)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+
+      - name: Generate SBOMs
+        env:
+          IMAGE: "ghcr.io/snapotter-hq/snapotter@sha256:${{ steps.digest.outputs.sha }}"
+          VERSION: ${{ needs.release.outputs.new_version }}
+        run: |
+          syft scan "$IMAGE" -o "cyclonedx-json=snapotter-v${VERSION}-sbom.cdx.json"
+          syft scan "$IMAGE" -o "spdx-json=snapotter-v${VERSION}-sbom.spdx.json"
+
+      - name: Upload SBOMs to GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.release.outputs.new_version }}
+        run: |
+          gh release upload "v${VERSION}" \
+            "snapotter-v${VERSION}-sbom.cdx.json" \
+            "snapotter-v${VERSION}-sbom.spdx.json" \
+            --clobber --repo snapotter-hq/SnapOtter
+
   manifest:
     name: Create Multi-Arch Manifests
     needs: [release, docker, scan]