From 9f697a296ed6e785ce33a71a20aec38811d65788 Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Thu, 30 Jul 2026 21:54:45 +0200
Subject: [PATCH] Merge SBOMs to array

---
 .github/workflows/sbom.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 24e69c3387..b1ff0540c8 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -28,11 +28,9 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pip-
       - name: Install system dependencies
-        run: sudo apt update && sudo apt install -y gettext unzip
+        run: sudo apt update && sudo apt install -y gettext unzip jq
       - name: Install node dependencies
         run: sudo npm install --global @cyclonedx/cyclonedx-npm
-      - name: Install CycloneDX CLI
-        run: wget https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.32.0/cyclonedx-linux-x64 && chmod +x cyclonedx-linux-x64
       - name: Install Python dependencies
         run: pip3 install -U uv cyclonedx-bom prisma-sbom-submit
       - name: Create empty environment
@@ -46,7 +44,7 @@ jobs:
       - name: Create JavaScript SBOM
         run: cyclonedx-npm > sbom-npm.json
       - name: Merge SBOMs
-        run: ./cyclonedx-linux-x64 merge --input-files sbom-python.json sbom-npm.json --output-format json --output-file sbom.json
+        run: jq -s "[.[0], .[1]]" sbom-python.json sbom-npm.json > sbom.json
       - name: Submit SBOM
         run: prisma-sbom-submit --server https://prisma.pretix.com sbom.json
         env: