CD workflow: generate SBOM artifact with least-privilege permissions

[Copilot]

Extends the CD workflow to generate an SBOM from the published container image and attach it as a workflow artifact. Adds only the permissions actually required — dropping the over-broad id-token: write and attestations: write that are only needed for signed supply-chain attestations (e.g. actions/attest-sbom), which this workflow does not create.

Changes

• .github/workflows/cd.yml
  • Added actions: write permission (required for artifact upload)
  • Added anchore/sbom-action step post-push, producing an SPDX JSON SBOM uploaded as sbom-<image-tag>.spdx.json
  • id-token: write and attestations: write are not included — anchore/sbom-action only needs actions: write to upload the artifact

permissions:
  contents: read
  packages: write
  actions: write   # artifact upload only; no OIDC/attestation needed

- name: Generate SBOM
  uses: anchore/sbom-action@0c39f226e1aa89d60625e475bb6270a458861361
  with:
    image: ${{ env.REGISTRY }}/thomasneuberger/tghomebot-api:${{ steps.imageTag.outputs.tag }}
    artifact-name: sbom-${{ steps.imageTag.outputs.tag }}.spdx.json
    output-file: sbom.spdx.json
    format: spdx-json

Original prompt

---

This section details on the original issue you should resolve

<issue_title>SBOM</issue_title>
<issue_description>Extend the CD workflow so that it creates an SBOM and ataches it to the run as an artifact</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes SBOM #61

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

[Copilot]

Pull request overview

Adds SBOM generation to the CD workflow so each deployed container image has a downloadable SPDX JSON SBOM attached to the workflow run (supports supply-chain visibility for releases).

Changes:

• Expanded workflow token permissions to support SBOM generation/attestation.
• Added an anchore/sbom-action step to generate an SPDX JSON SBOM for the pushed image and upload it as an artifact.