From 213522d5de792f4ea016e1ce31bb18ed6a1545f3 Mon Sep 17 00:00:00 2001
From: Tim Meusel <tim@bastelfreak.de>
Date: Fri, 18 Sep 2026 13:50:11 +0200
Subject: [PATCH] Release: update SBOM

Update the SBOM data on each puppet-runtime release

Signed-off-by: Tim Meusel <tim@bastelfreak.de>
---
 .github/workflows/release.yml | 57 +++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 449d0bfd..ed073741 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,3 +38,60 @@ jobs:
     secrets:
       github_pat: ${{ secrets.OPENVOXBOT_COMMIT_AND_PRS }}
       ssh_private_key: ${{ secrets.OPENVOXBOT_SSH_PRIVATE_KEY }}
+
+  update_sbom_data:
+    name: Update openvox-sbom-tools data
+    needs: release
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'OpenVoxProject'
+    steps:
+      - name: Checkout openvox-sbom-tools
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: OpenVoxProject/openvox-sbom-tools
+          token: ${{ secrets.OPENVOXBOT_COMMIT_AND_PRS }}
+          path: openvox-sbom-tools
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
+        env:
+          BUNDLE_GEMFILE: ${{ github.workspace }}/openvox-sbom-tools/Gemfile
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+
+      - name: Setup git and SSH signing
+        id: git_identity
+        uses: OpenVoxProject/shared-actions/.github/actions/setup-git-ssh-signing@main
+        with:
+          ssh_private_key: ${{ secrets.OPENVOXBOT_SSH_PRIVATE_KEY }}
+
+      - name: Update SBOM data
+        working-directory: openvox-sbom-tools
+        run: bundle exec rake vox:sbom:update_data
+
+      - name: Detect changes
+        id: changes
+        working-directory: openvox-sbom-tools
+        run: |
+          if [[ -n "$(git status --porcelain)" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create pull Request
+        if: steps.changes.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          path: openvox-sbom-tools
+          token: ${{ secrets.OPENVOXBOT_COMMIT_AND_PRS }}
+          signoff: true
+          branch: sbom-data-update-puppet-runtime-${{ needs.get_version.outputs.version }}
+          delete-branch: true
+          commit-message: "Update SBOM data for puppet-runtime ${{ needs.get_version.outputs.version }}"
+          title: "Update SBOM data for puppet-runtime ${{ needs.get_version.outputs.version }}"
+          body: |
+            Automated SBOM data update after puppet-runtime release ${{ needs.get_version.outputs.version }}.
+          author: '${{ env.GIT_AUTHOR_NAME }} <${{ env.GIT_AUTHOR_EMAIL }}>'
+          committer: '${{ env.GIT_COMMITTER_NAME }} <${{ env.GIT_COMMITTER_EMAIL }}>'