From 4c91ad8b61404b4f3825906f80be08c8244dd807 Mon Sep 17 00:00:00 2001
From: enzowritescode <1328683+enzowritescode@users.noreply.github.com>
Date: Wed, 14 Aug 2024 09:31:18 -0600
Subject: [PATCH] Add SBOM generation on release (#27733)

* Add SBOM generation on release

* Fix release-note NONE in PR template
---
 .github/PULL_REQUEST_TEMPLATE.md |  2 +-
 .github/workflows/snyk-sbom.yml  | 34 ++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/snyk-sbom.yml

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 9f8b2c22c1..77c093633f 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -56,7 +56,7 @@ Added new API endpoints POST /api/v4/foo, GET api/v4/foo, and GET api/v4/foo/:fo
 Added a new config setting ServiceSettings.FooBar. Added a new column Foo to the Users table.
 ```
 
-```
+```release-note
 NONE
 ```
 -->
diff --git a/.github/workflows/snyk-sbom.yml b/.github/workflows/snyk-sbom.yml
new file mode 100644
index 0000000000..fee6244f4c
--- /dev/null
+++ b/.github/workflows/snyk-sbom.yml
@@ -0,0 +1,34 @@
+name: Snyk - Software Bill of Materials (SBOM)
+on:
+  release:
+    types: [published]
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Setup Node
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+        with:
+          node-version: '22.6.0'
+
+      - name: Install Snyk CLI
+        run: npm install -g snyk@1.1292.2
+
+      - name: Generate SBOM
+        run: snyk sbom --format=cyclonedx1.5+json --all-projects > sbom.json
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      - name: Upload SBOM
+        uses: Shopify/upload-to-release@c77c9b3e5d288adaef98a7007bf92340ec6ce03b # v2.0.0
+        with:
+          name: sbom.json
+          path: sbom.json
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          content-type: application/json