This workflow creates bill of material and uploads it to Dependency-Track each night #19

	name: 'This workflow creates bill of material and uploads it to Dependency-Track each night'

	on:
	schedule:
	- cron: '0 0 * * *'
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow}}-${{ github.ref }}
	cancel-in-progress: true

	defaults:
	run:
	shell: bash

	jobs:
	create-bom:
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 18.x

	- name: Install
	run: yarn install --frozen-lockfile

	- name: Install CycloneDX CLI
	run: \|
	curl -s https://api.github.com/repos/CycloneDX/cyclonedx-cli/releases/latest \| grep "browser_download_url.*linux.x64" \| cut -d '"' -f 4 \| wget -i -
	sudo mv cyclonedx-linux-x64 /usr/local/bin/
	sudo chmod +x /usr/local/bin/cyclonedx-linux-x64

	- name: Generate BOMs
	run: \|
	npm install -g @cyclonedx/cdxgen
	cdxgen -o sbom.json

	- name: Upload SBOM to DependencyTrack
	env:
	DEPENDENCY_TRACK_API: 'https://dt.security.dhis2.org/api/v1/bom'
	run: \|
	curl -X POST "$DEPENDENCY_TRACK_API" \
	--fail-with-body \
	-H "Content-Type: multipart/form-data" \
	-H "X-Api-Key: ${{ secrets.DEPENDENCYTRACK_APIKEY }}" \
	-F "project=c0bd0f2d-d512-460a-81f9-e256e4fb1054" \
	-F "bom=@sbom.json"

Provide feedback