From df51802042ab1fa6add532ef7f012bf74dd8b37f Mon Sep 17 00:00:00 2001
From: christophercampbell <christopher.campbell@circle.com>
Date: Tue, 25 Aug 2026 14:36:58 -0400
Subject: [PATCH] ci: attach dependency SBOM to release assets

---
 .github/workflows/release-binaries.yaml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml
index 6fd313fa..529d3ac2 100644
--- a/.github/workflows/release-binaries.yaml
+++ b/.github/workflows/release-binaries.yaml
@@ -188,6 +188,20 @@ jobs:
           name: release-assets
           path: release-assets/
 
+      - name: Generate SBOM from Dependency Graph
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        with:
+          script: |
+            const fs = require('fs');
+            const { data } = await github.rest.dependencyGraph.exportSbom({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+            const name = `${context.repo.repo}_${process.env.TAG}_${context.sha.substr(0, 8)}.spdx.json`;
+            fs.writeFileSync(`release-assets/${name}`, JSON.stringify(data.sbom));
+
       - name: Upload release assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}