OpenFGA MCP

name: "Security: SBOM" on: release: types: [published] workflow_dispatch: inputs: tag: description: "Release tag to generate SBOM for" required: true type: string permissions: contents: read jobs: build: name: "Generate SBOM" runs-on: ubuntu-latest permissions: contents: write packages: write steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 with: egress-policy: audit - name: Checkout code uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: ref: ${{ github.event.release.tag_name || inputs.tag }} - name: Setup PHP uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5 with: php-version: "8.3" coverage: none tools: composer:v2 - name: Install dependencies run: composer install --no-dev --no-interaction --prefer-dist - name: Install SBOM composer plugin run: |- composer global config --no-plugins allow-plugins.cyclonedx/cyclonedx-php-composer true composer global require cyclonedx/cyclonedx-php-composer - name: Generate SBOM run: composer cyclonedx:make-sbom --output-format=JSON --output-file=sbom.cyclonedx.json - name: Upload SBOM as artifact uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 with: name: sbom path: sbom.cyclonedx.json retention-days: 30 - name: Upload SBOM to Release if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' env: GH_TOKEN: ${{ github.token }} run: | TAG="${{ github.event.release.tag_name || inputs.tag }}" echo "Uploading SBOM to release $TAG" # Rename SBOM to include version mv sbom.cyclonedx.json "openfga-mcp-${TAG}-sbom.cyclonedx.json" # Upload to the release gh release upload "$TAG" "openfga-mcp-${TAG}-sbom.cyclonedx.json" \ --repo "${{ github.repository }}" \ --clobber