Add an sbom workflow

.github/workflows/sbom.yml

@@ -0,0 +1,81 @@
+name: SBOM Generator
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+  workflow_dispatch:
+
+permissions: write-all
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "18"
+          check-latest: true
+          cache: 'yarn'
+
+      - name: Install Microsoft SBOM Tool
+        run: |
+          curl -Lo /tmp/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
+          chmod +x /tmp/sbom-tool
+
+      - name: Install project dependencies
+        run: yarn install --frozen-lockfile --production
+
+      - name: sbomtool expects a directory to exist to place results in
+        run: |
+          mkdir -p /tmp/sbomtool/directory
+          mkdir -p /tmp/sbomtool/image
+
+      - name: sbomtool directory spdx
+        if: always()
+        run: /tmp/sbom-tool generate -b . -bc . -li true -pm true -m /tmp/sbomtool/directory -pn Heimdall2 -pv 2.10.19 -ps MITRE -nsb https://saf.mitre.org -V Verbose
+
+      - name: bug in cyclonedxcli spdx converter causes a valid field to throw an error, applying a workaround
+        if: always()
+        run: sed 's/PACKAGE-MANAGER/PACKAGE_MANAGER/g' /tmp/sbomtool/directory/_manifest/spdx_2.2/manifest.spdx.json > /tmp/sbomtool/directory/_manifest/spdx_2.2/manifest_fixed.spdx.json
+
+      - run: tree /tmp/sbomtool
+
+      - run: chmod 777 /tmp/sbomtool/directory/_manifest/spdx_2.2/manifest_fixed.spdx.json
+
+      - run: ls -lah /tmp/sbomtool/directory/_manifest/spdx_2.2/manifest_fixed.spdx.json
+
+      - name: sbomtool check permissions in container
+        if: always()
+        run: docker run -t -v /tmp/sbomtool/directory/_manifest/spdx_2.2/manifest_fixed.spdx.json:/tmp/sbomtool_directory.spdx.json -v /tmp/sbomtool/directory.cdx.json:/tmp/sbomtool_directory.cdx.json --entrypoint /bin/bash cyclonedx/cyclonedx-cli:latest -- /bin/ls -lah /tmp
+
+      - name: sbomtool directory spdx converted
+        if: always()
+        run: docker run -t -v /tmp/sbomtool/directory/_manifest/spdx_2.2/manifest_fixed.spdx.json:/tmp/sbomtool_directory.spdx.json -v /tmp/sbomtool/directory.cdx.json:/tmp/sbomtool_directory.cdx.json cyclonedx/cyclonedx-cli:latest convert --input-file /tmp/sbomtool_directory.spdx.json --output-file /tmp/sbomtool_directory.cdx.json  --input-format spdxjson --output-format json 
+
+      - name: Build the Docker image
+        if: always()
+        run: docker build -f Dockerfile -t mitre/heimdall2:throwaway .
+
+      - name: sbomtool image spdx
+        if: always()
+        run: /tmp/sbom-tool generate -di mitre/heimdall2:throwaway -li true -pm true -m /tmp/sbomtool/image -pn Heimdall2 -pv 2.10.19 -ps MITRE -nsb https://saf.mitre.org -V Verbose
+
+      - name: bug in cyclonedxcli spdx converter causes a valid field to throw an error, applying a workaround
+        if: always()
+        run: sed 's/PACKAGE-MANAGER/PACKAGE_MANAGER/g' /tmp/sbomtool/image/_manifest/spdx_2.2/manifest.spdx.json > /tmp/sbomtool/image/_manifest/spdx_2.2/manifest_fixed.spdx.json
+
+      - name: sbomtool image spdx converted
+        if: always()
+        run: docker run -t -v /tmp/sbomtool/image/_manifest/spdx_2.2/manifest_fixed.spdx.json:/tmp/sbomtool_image.spdx.json -v /tmp/sbomtool/image.cdx.json:/tmp/sbomtool_image.cdx.json cyclonedx/cyclonedx-cli:latest convert --input-file /tmp/sbomtool_image.spdx.json --output-file /tmp/sbomtool_image.cdx.json  --input-format spdxjson --output-format json 
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with: 
+          path: /tmp/sbomtool
+          name: "MS SBOM Tool experiments"