525: add SBOM attestation

.github/workflows/build-assets.yml

@@ -61,10 +61,22 @@ jobs:
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
           subject-path: '${{ github.workspace }}/pie.phar'
+      - name: Make SBOM
+        run: composer CycloneDX:make-sbom --output-format=JSON --output-file=sbom.json --omit=dev
+      - name: Attest the SBOM
+        if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
+        with:
+          subject-path: '${{ github.workspace }}/pie.phar'
+          sbom-path: '${{ github.workspace }}/sbom.json'
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: pie-${{ github.sha }}.phar
           path: pie.phar
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: pie-${{ github.sha }}-sbom.json
+          path: sbom.json
 
   build-executable:
     needs:

.github/workflows/release.yml

@@ -61,12 +61,20 @@ jobs:
           path: executable-pie-binaries
           pattern: pie-${{ github.sha }}-*.bin
           merge-multiple: true
+      - name: Fetch the PHAR's SBOM from artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+        with:
+          name: pie-${{ github.sha }}-sbom.json
       - name: Verify the PHAR and binaries
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh attestation verify pie.phar --repo ${{ github.repository }} ;
           find executable-pie-binaries -type f -exec gh attestation verify {} --repo ${{ github.repository }} \;
+      - name: Verify the PHAR's SBOM attestation
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh attestation verify pie.phar --repo ${{ github.repository }} --predicate-type https://cyclonedx.org/bom
       # Once the PHAR and binaries have been attached to the release, it is
       # ready for review before publishing it. Note that if immutable releases
       # are enabled, the tag, pre-release/latest release flag, and all assets
@@ -77,6 +85,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release upload "${GITHUB_REF_NAME}" "pie.phar" --clobber ;
+          gh release upload "${GITHUB_REF_NAME}" "sbom.json" --clobber ;
           find executable-pie-binaries -type f -exec gh release upload "${GITHUB_REF_NAME}" {} --clobber \;
 
   build-and-push-docker-image:

composer.json

@@ -45,6 +45,7 @@
         "ext-openssl": "*",
         "behat/behat": "^3.29.0",
         "bnf/phpstan-psr-container": "^1.1",
+        "cyclonedx/cyclonedx-php-composer": "^6.2.0",
         "doctrine/coding-standard": "^14.0.0",
         "phpstan/phpstan": "^2.2.5",
         "phpstan/phpstan-phpunit": "^2.0.18",
@@ -62,7 +63,8 @@
         "preferred-install": "dist",
         "bump-after-update": true,
         "allow-plugins": {
-            "dealerdirect/phpcodesniffer-composer-installer": true
+            "dealerdirect/phpcodesniffer-composer-installer": true,
+            "cyclonedx/cyclonedx-php-composer": true
         },
         "platform": {
             "php": "8.1.99"