create action for tool

[fnxpt]

Allow cyclonedx-node-npm to be executed using github actions

name: Generate SBOM

on:

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
    - uses: CycloneDX/cyclonedx-node-npm
      with:
        path: "."

[jkowalleck]

thanks for the contribution, @fnxpt, but
could you give any context to this particular Pull request ?
I don't see a description, and the commit message only says "create action for tool".

I will put this PR on "DRAFT" until this is clarified.

[fnxpt]

Sorry about that, the idea is to allow the usage of the tool directly on a github action.
In my use case I want to be able to run this action on my release workflow, so whenever I release a new version I generate a new SBOM

[jkowalleck]

Firstly: let's discuss via #473 the reasons behind it, to help understand responsibilities and capabilities of such a GH-Action.

[jkowalleck]

Issues I have with the current state of the pullrequest, that need to be discussed:
There are multiple things to be considered, before your solution could be actually taken into account:

Your solution would always install some version of @cyclonedx/cyclonedx-npm via npm, while it is sitting in a repo with a probably different version of the tool itself.
This might conflict with user expectations.

How should action versioning work? The version of an GH action is a tag.
If the action just uses installs always the latest version of @cyclonedx/cyclonedx-npm, this conflicts with the tools version.
And it does not know semantic versioning - having a proper action sitting in the same repo as the tool is cumbersome and error-prone.

[fnxpt]

Ok, so the @ghaction is a branch but it was just to give context, when used, users should use either a branch or a tag, and maybe we should add an additional parameter to get a specific version of the tool

[fnxpt]

updated the PR with an input for the version and also some instructions on the README

[jkowalleck]

Hello, @fnxpt, I am the author and maintainer of this tool.
Please come to #473 and tell what all this is about.
Let's talk first, implement later. :)

[fnxpt]

Closing this since we can use npx to run it directly