Item 10: Add SBOM generation step to all appimage workflows

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

.github/workflows/appimage10.yml

@@ -306,6 +306,11 @@ jobs:
           cd appimage/10
           make validate
 
+      - name: Extract AppImage for SBOM scan
+        run: |
+          cd appimage/10
+          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
+
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/10
@@ -398,6 +403,15 @@ jobs:
             ${{ github.workspace }}/appimage/10/${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}
             ${{ github.workspace }}/appimage/10/RELEASE-NOTES-EL10.txt
 
+      - name: Generate SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: ${{ github.workspace }}/appimage/10/squashfs-root
+          format: spdx-json
+          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: true
+          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+
       - name: Upload Artifact
         #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
         uses: actions/upload-artifact@v7

.github/workflows/appimage7.yml

@@ -306,6 +306,11 @@ jobs:
           cd appimage/7
           make validate
 
+      - name: Extract AppImage for SBOM scan
+        run: |
+          cd appimage/7
+          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
+
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/7
@@ -398,6 +403,15 @@ jobs:
             ${{ github.workspace }}/appimage/7/${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}
             ${{ github.workspace }}/appimage/7/RELEASE-NOTES-EL7.txt
 
+      - name: Generate SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: ${{ github.workspace }}/appimage/7/squashfs-root
+          format: spdx-json
+          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: true
+          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+
       - name: Upload Artifact
         #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
         uses: actions/upload-artifact@v7

.github/workflows/appimage8.yml

@@ -306,6 +306,11 @@ jobs:
           cd appimage/8
           make validate
 
+      - name: Extract AppImage for SBOM scan
+        run: |
+          cd appimage/8
+          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
+
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/8
@@ -398,6 +403,15 @@ jobs:
             ${{ github.workspace }}/appimage/8/${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}
             ${{ github.workspace }}/appimage/8/RELEASE-NOTES-EL8.txt
 
+      - name: Generate SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: ${{ github.workspace }}/appimage/8/squashfs-root
+          format: spdx-json
+          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: true
+          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+
       - name: Upload Artifact
         #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
         uses: actions/upload-artifact@v7

.github/workflows/appimage9.yml

@@ -306,6 +306,11 @@ jobs:
           cd appimage/9
           make validate
 
+      - name: Extract AppImage for SBOM scan
+        run: |
+          cd appimage/9
+          ./${MAGIC_APPIMAGE_OUTPUT_FILENAME} --appimage-extract
+
       - name: Create RELEASE-NOTES.txt
         run: |
           cd appimage/9
@@ -398,6 +403,15 @@ jobs:
             ${{ github.workspace }}/appimage/9/${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}
             ${{ github.workspace }}/appimage/9/RELEASE-NOTES-EL9.txt
 
+      - name: Generate SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: ${{ github.workspace }}/appimage/9/squashfs-root
+          format: spdx-json
+          artifact-name: sbom-${{env.MAGIC_APPIMAGE_OUTPUT_FILENAME}}.spdx.json
+          upload-artifact: true
+          upload-release-assets: ${{ env.MY_GITHUB_TAG != '' }}
+
       - name: Upload Artifact
         #if: ${{ env.MY_GITHUB_TAG == '' }} # commented out to always upload
         uses: actions/upload-artifact@v7