OpenFGA MCP

name: "Security: SBOM" on: release: types: [published] workflow_dispatch: inputs: tag: description: "Release tag to generate SBOM for" required: true type: string permissions: contents: read jobs: build: name: "Generate SBOM" runs-on: ubuntu-latest permissions: contents: write packages: write steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0 with: egress-policy: audit - name: Checkout code uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: ref: ${{ github.event.release.tag_name || inputs.tag }} - name: Setup PHP uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # 2.35.4 with: php-version: "8.3" coverage: none tools: composer:v2 - name: Install dependencies run: composer install --no-dev --no-interaction --prefer-dist - name: Install SBOM composer plugin run: |- composer global config --no-plugins allow-plugins.cyclonedx/cyclonedx-php-composer true composer global require cyclonedx/cyclonedx-php-composer - name: Generate SBOM run: composer cyclonedx:make-sbom --output-format=JSON --output-file=sbom.cyclonedx.json - name: Upload SBOM as artifact uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: sbom path: sbom.cyclonedx.json retention-days: 30 - name: Upload SBOM to Release if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' env: GH_TOKEN: ${{ github.token }} run: | TAG="${{ github.event.release.tag_name || inputs.tag }}" echo "Uploading SBOM to release $TAG" # Rename SBOM to include version mv sbom.cyclonedx.json "openfga-mcp-${TAG}-sbom.cyclonedx.json" # Upload to the release gh release upload "$TAG" "openfga-mcp-${TAG}-sbom.cyclonedx.json" \ --repo "${{ github.repository }}" \ --clobber