init

.github/workflows/sbom.yml

@@ -0,0 +1,26 @@
+name: SBOM Generation
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Generate SBOM (SPDX)
+        uses: anchore/sbom-action@v0
+        with:
+          artifact-name: career-ops-sbom.spdx.json
+          format: spdx-json
+          output-file: career-ops-sbom.spdx.json
+
+      - name: Upload SBOM to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload ${{ github.event.release.tag_name }} career-ops-sbom.spdx.json