action.yml

name: 'Generate Actions SBOM'
description: 'Generates a CycloneDX SBOM of all GitHub Actions used in the current workflow, with refs resolved to commit SHAs.'

inputs:
  output-file:
    description: 'Path to write the SBOM JSON output file'
    required: false
    default: 'actions-sbom.json'
  github-token:
    description: 'GitHub token used to resolve action refs to commit SHAs via the API'
    required: false
    default: ${{ github.token }}
  workflow-file:
    description: 'Explicit path to the workflow file to scan (relative to repo root). Auto-detected from GITHUB_WORKFLOW_REF when omitted.'
    required: false
    default: ''

outputs:
  sbom-path:
    description: 'Absolute path to the generated SBOM file'
    value: ${{ steps.generate.outputs.sbom-path }}
  component-count:
    description: 'Number of action components included in the SBOM'
    value: ${{ steps.generate.outputs.component-count }}

runs:
  using: composite
  steps:
    - name: Check Python availability
      shell: bash
      run: |
        if ! command -v python3 &>/dev/null; then
          echo "::error::python3 is required but not available on this runner"
          exit 1
        fi
        python3 -c "import yaml" 2>/dev/null || pip3 install pyyaml --quiet

    - name: Generate SBOM
      id: generate
      shell: bash
      env:
        GITHUB_TOKEN: ${{ inputs.github-token }}
        SBOM_OUTPUT_FILE: ${{ inputs.output-file }}
        SBOM_WORKFLOW_FILE: ${{ inputs.workflow-file }}
      run: python3 "${{ github.action_path }}/scripts/generate_sbom.py"