Add SBOM generator

[sydseter]

This will probably be required at some point.

We may need to generate three of them, not sure, seeing that we have the card converter, the website, and the game engine.

[rewtd]

We can use https://github.com/CycloneDX/cdxgen-action to generate all the SBOMs I think.

• Game engine (copi) == Elixir ✅
• Website == Node ✅
• Card converter == Python ✅

[sydseter]

We need to make sure we release it as well: https://github.com/OWASP/cornucopia/actions/runs/18412255568/job/52467450543

[sydseter]

It’s only creating sbom for the card converter so we need to look at that as well.

bom.xml reports.zip

[sydseter]

Instead of the upload-artifact step we can try this:

- name: Add file to existing release
   uses: softprops/action-gh-release@v2 
   if: startsWith(github.ref, 'refs/tags/')
     with:
       files: reports

Then trigger the dependency report generation when a release tag is pushed.

on:
  push:
      tags:
          - "v*"
          - pre-release

[sydseter]

generating a report for each pull-request, besides for testing, might not give that much value when I think about it.

[rewtd]

You suggesting that we move it to the release workflow?

[sydseter]

Yes, my line of thought is that the value here is for others to have a full overview of our dependencies, not necessarily for us to have one.