From 2e8e6a6b0770d88e1782f587a7ea5a55fbbe3095 Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@pretix.eu>
Date: Tue, 25 Aug 2026 15:28:15 +0200
Subject: [PATCH] SBOM creation and upload (#6499)

* Build and upload SBOM

* Merge SBOMs

* Use official cli

* Remove matrix

* Merge SBOMs to array

* Use newer sbom-submit

* debug

* Remove debug

* Explicitly setup node

* Add npm location

* Add test

* REmove test call
---
 .github/workflows/sbom.yml | 43 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/sbom.yml

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
new file mode 100644
index 0000000000..9845bd20e0
--- /dev/null
+++ b/.github/workflows/sbom.yml
@@ -0,0 +1,43 @@
+name: SBOM
+
+on:
+  push:
+    branches: [ master, sbom ]
+    tags: [ 'v.*' ]
+
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
+env:
+  FORCE_COLOR: 1
+
+jobs:
+  test:
+    runs-on: ubuntu-22.04
+    name: Submission
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Use Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24.x'
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install system dependencies
+        run: sudo apt update && sudo apt install -y gettext unzip
+      - name: Install Python dependencies
+        run: pip3 install -U "prisma-sbom-submit[python]"
+      - name: Create SBOM
+        run: NPM=$(which npm) prisma-sbom-submit collect . sbom.json
+      - name: Submit SBOM
+        run: prisma-sbom-submit upload --server https://prisma.pretix.com sbom.json
+        env:
+          PRISMA_UPLOAD_TOKEN: ${{ secrets.PRISMA_UPLOAD_TOKEN }}