brew/.github/workflows/sbom.yml at main · Workbrew/brew · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
name: Update SBOM schema
on:
  push:
    paths:
      - .github/workflows/sbom.yml
    branches-ignore:
      - main
      - master
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:

permissions:
  contents: read

defaults:
  run:
    shell: bash -xeuo pipefail {0}

jobs:
  sbom:
    if: github.repository == 'Homebrew/brew'
    runs-on: ubuntu-latest
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          core: false
          cask: false

      - name: Configure Git user
        uses: Homebrew/actions/git-user-config@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          username: BrewTestBot

      - name: Set up commit signing
        if: github.actor != 'dependabot[bot]'
        uses: Homebrew/actions/setup-commit-signing@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          signing_key: ${{ secrets.BREWTESTBOT_SSH_SIGNING_KEY }}

      - name: Update schema data
        id: update
        env:
          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
        run: |
          git fetch origin

          BRANCH="schema-update"
          echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"

          if git ls-remote --exit-code --heads origin "${BRANCH}"
          then
            git checkout "${BRANCH}"
            git checkout "Library/Homebrew/data/schemas"
          else
            git checkout --no-track -B "${BRANCH}" origin/HEAD
          fi

          # Intentionally tracking 2.3.x to match what we output in sbom.rb. 3.0 also doesn't have a JSON Schema.
          # Note: this is a 2.3.1 development branch - not a 2.3.1 tag. It contains bugfixes compared to 2.3.0.
          curl --location --output Library/Homebrew/data/schemas/sbom.json https://raw.githubusercontent.com/spdx/spdx-spec/support/v2.3.1/schemas/spdx-schema.json
          # https://github.com/spdx/spdx-spec/pull/1029
          sed -i -e 's|\(2019-09/schema\)#|\1|' Library/Homebrew/data/schemas/sbom.json

          if ! git diff --exit-code Library/Homebrew/data/schemas
          then
            git add "Library/Homebrew/data/schemas"
            git commit -m "data/schemas: update schema data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/HEAD/.github/workflows/sbom.yml)."

            echo "committed=true" >> "$GITHUB_OUTPUT"
            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state" || true)"
            if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]]
            then
              echo "pull_request=true" >> "$GITHUB_OUTPUT"
            fi
          fi

      - name: Push commits
        if: steps.update.outputs.committed == 'true' && github.actor != 'dependabot[bot]'
        uses: Homebrew/actions/git-try-push@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
          directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
          branch: ${{ steps.update.outputs.branch }}
          force: true
          origin_branch: "HEAD"

      - name: Open a pull request
        if: steps.update.outputs.pull_request == 'true' && github.actor != 'dependabot[bot]'
        run: gh pr create --fill
        env:
          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}

  issue:
    needs: sbom
    if: always() && github.event_name == 'schedule' && github.repository == 'Homebrew/brew'
    runs-on: ubuntu-slim
    env:
      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
    permissions:
      # To create or update issues
      issues: write
    steps:
      - name: Open, update, or close schema issue
        uses: Homebrew/actions/create-or-update-issue@3cdb78d0f62ad29dd32de765782654f4eedea607 # 2026.08.31.1
        with:
          title: Failed to update SBOM schema
          body: >
            The SBOM schema workflow [failed](${{ env.RUN_URL }}). No SBOM schema was updated.
          labels: bug
          update-existing: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
          close-existing: ${{ needs.sbom.result == 'success' }}
          close-from-author: github-actions[bot]
          close-comment: >
            The SBOM schema workflow [succeeded](${{ env.RUN_URL }}). Closing this issue.