verify-spdx.yaml

name: Validate SPDX Conformance

on:
  pull_request:
    branches: ['main']

jobs:
  check-spdx:
    name: Check SPDX SBOMs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v3.3.0
        with:
          go-version: '1.22'
          check-latest: true

      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
      - run: |
          go run ./cmd/bom/main.go generate -i registry.k8s.io/pause > example-image-pause.spdx
          go run ./cmd/bom/main.go generate --format=json -i registry.k8s.io/pause > example-image-pause.spdx.json

      - uses: chainguard-dev/actions/setup-spdx@d886686603afb809f7ef9b734b333e20b7ce5cda
        with:
          spdx-tools-version: 1.1.0

      - uses: chainguard-dev/actions/setup-spdx@d886686603afb809f7ef9b734b333e20b7ce5cda
        with:
          download: false
          spdx-tools-version: 1.1.0
          sbom-path: example-image-pause.spdx

      - uses: chainguard-dev/actions/setup-spdx@d886686603afb809f7ef9b734b333e20b7ce5cda
        with:
          download: false
          spdx-tools-version: 1.1.0
          sbom-path: example-image-pause.spdx.json

      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3  # v4.3.1
        if: ${{ always() }}
        with:
          name: Example SBOMs
          path: |
            example-image-pause.spdx
            example-image-pause.spdx.json