ci: sbom changes to be pushed in an specific branch with signed commits

Author: jesmrec

.github/workflows/sbom.yml

@@ -4,12 +4,7 @@ on:
   workflow_dispatch:
   push:
     branches:
-    - feature/*
-    - fix/*
-    - improvement/*
-    - release/*
-    - technical/*
-    - 'dependabot/**'
+    - master
 
 # Cancels other executions in the same branch
 concurrency:
@@ -21,9 +16,9 @@ permissions:
 
 jobs:
   sbom:
-    # Skip if the job was triggered by the SBOM commit or a merge commit in the latest push.
-    if: "!contains(github.event.head_commit.message, 'Merge pull request') && !contains(github.event.head_commit.message, 'SBOM updated')"
     runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: chore/sbom-update
 
     steps:
       # Checkout the repository
@@ -34,7 +29,6 @@ jobs:
           fetch-depth: 2
           persist-credentials: false
 
-
       # Cache Gradle dependencies to speed up future builds
       - name: Cache Gradle dependencies
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 #v5.0.4
@@ -79,12 +73,26 @@ jobs:
           EOF
           chmod +x normalize-sbom.sh
 
-      # Compares with the HEAD to check if there are changes
-      - name: Compare with previous SBOM
+      # Compare with the SBOM update branch, or master as fallback
+      - name: Compare with previous SBOM in branch or master as fallback
         id: compare
         run: |
-          # Try HEAD first to compare with previous commit's sbom (HEAD~1)
-          git show HEAD~1:sbom.json > sbom_prev.json 2>/dev/null || echo '{}' > sbom_prev.json
+          FALLBACK_BRANCH="master"
+
+          echo "Looking for previous SBOM..."
+
+          # Make sure remote references are available
+          git fetch origin "$SOURCE_BRANCH" "$FALLBACK_BRANCH" --depth=1 || true
+
+          if git ls-remote --exit-code --heads origin "$SOURCE_BRANCH" > /dev/null 2>&1; then
+            PREVIOUS_SBOM_REF="origin/$SOURCE_BRANCH"
+            echo "Branch $SOURCE_BRANCH exists. Using sbom.json from $PREVIOUS_SBOM_REF"
+          else
+            PREVIOUS_SBOM_REF="origin/$FALLBACK_BRANCH"
+            echo "Branch $SOURCE_BRANCH does not exist. Using sbom.json from $PREVIOUS_SBOM_REF"
+          fi
+
+          git show "$PREVIOUS_SBOM_REF:sbom.json" > sbom_prev.json
 
           ./normalize-sbom.sh sbom_prev.json sbom_prev_normalized.json
           ./normalize-sbom.sh sbom.json sbom_current_normalized.json
@@ -100,19 +108,24 @@ jobs:
 
       # Generate a token to perform the commit in the next step 
       - name: Generate GitHub App token
+        if: steps.compare.outputs.no_changes == 'false'
         id: app-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
           app-id: ${{ secrets.SBOM_APP_ID }}
           private-key: ${{ secrets.SBOM_APP_PRIVATE_KEY }}
 
-      # Commit the SBOM file only if it differs from master to avoid unnecessary commits
-      - name: Commit and push updated SBOM
+      # Create a branch with latest SBOM changes only if there are changes
+      - name: Create or update SBOM PR
         if: steps.compare.outputs.no_changes == 'false'
-        uses: GuillaumeFalourd/git-commit-push@205c043bca2f932f7a48a28a8d619ba30eb84baf #v1.3
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
-          commit_message: "docs: SBOM updated"
-          files: sbom.json
-          email: devops@owncloud.com
-          name: ownClouders
-          access_token: ${{ steps.app-token.outputs.token }}
+          add-paths: sbom.json
+          token: ${{ steps.app-token.outputs.token }}
+          branch: ${{ env.SOURCE_BRANCH }}
+          base: master
+          commit-message: "chore: update SBOM"
+          title: "chore: update sbom.json"
+          body: "Automated SBOM update. This pull request is updated on each push to `master` or manual dispatch — merging it will close it and a fresh one will be opened on the next change."
+          delete-branch: true
+          sign-commits: true