name: sbom-scan
on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
permissions: read-all
jobs:
  scan-sboms:
    name: scan-release-sboms
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - id: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          RELEASE=$(gh release list -R goreleaser/goreleaser --exclude-pre-releases --limit 1 --json tagName | jq -r '.[0].tagName')
          echo "tag=$RELEASE" >> $GITHUB_OUTPUT
      - env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release download -R goreleaser/goreleaser "${{ steps.release.outputs.tag }}" --pattern goreleaser_Linux_x86_64.tar.gz.sbom.json
      - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
        id: scan
        with:
          sbom: goreleaser_Linux_x86_64.tar.gz.sbom.json
          fail-build: true
          severity-cutoff: critical
      - if: always()
        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
