From a0f5ebef42a651ffbad8f4175a872944790b8c46 Mon Sep 17 00:00:00 2001
From: Ricardo Lopes <ricardoapl.dev@gmail.com>
Date: Wed, 24 Apr 2024 17:17:59 +0100
Subject: [PATCH 1/4] ci: generate sbom on release

Signed-off-by: Ricardo Lopes <ricardoapl.dev@gmail.com>
---
 .github/workflows/sbom.yaml | 41 +++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .github/workflows/sbom.yaml

diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
new file mode 100644
index 0000000000..7fa9d16ba5
--- /dev/null
+++ b/.github/workflows/sbom.yaml
@@ -0,0 +1,41 @@
+name: Generate SBOM with Kubernetes BOM
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    env:
+      OUTPUT: kube-state-metrics-${{ github.ref_name }}.spdx
+      TAG: ${{ github.ref_name }}
+
+    steps:
+      - name: Fetch source code into GITHUB_WORKSPACE
+        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+
+      - name: Install Kubernetes BOM
+        uses: kubernetes-sigs/release-actions/setup-bom@841d76a188a7c121231a863572e27012805715a2 # v0.1.4
+
+      - name: Generate SBOM
+        run: |
+          bom generate \
+            --dirs=. \
+            --image=registry.k8s.io/kube-state-metrics/kube-state-metrics:$TAG \
+            --namespace=https://github.com/kubernetes/kube-state-metrics/releases/download/$TAG/$OUTPUT
+            --output=$OUTPUT
+
+      - name: Upload SBOM to GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload $TAG $OUTPUT

From 7fc6c5dd2e6596d6534587497c2821c090bf9555 Mon Sep 17 00:00:00 2001
From: Ricardo Lopes <ricardoapl.dev@gmail.com>
Date: Thu, 25 Apr 2024 15:44:33 +0100
Subject: [PATCH 2/4] ci: fetch tag name on release

Signed-off-by: Ricardo Lopes <ricardoapl.dev@gmail.com>
---
 .github/workflows/sbom.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 7fa9d16ba5..819cc133d6 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -16,8 +16,8 @@ jobs:
       contents: write
 
     env:
-      OUTPUT: kube-state-metrics-${{ github.ref_name }}.spdx
-      TAG: ${{ github.ref_name }}
+      OUTPUT: kube-state-metrics-${{ github.event.release.tag_name }}.spdx
+      TAG: ${{ github.event.release.tag_name }}
 
     steps:
       - name: Fetch source code into GITHUB_WORKSPACE

From 2a235100190e26cf42799f5eacbd77eb7daa6857 Mon Sep 17 00:00:00 2001
From: Ricardo Lopes <ricardoapl.dev@gmail.com>
Date: Thu, 25 Apr 2024 16:18:56 +0100
Subject: [PATCH 3/4] ci: trigger on release but not on pre-release

Signed-off-by: Ricardo Lopes <ricardoapl.dev@gmail.com>
---
 .github/workflows/sbom.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 819cc133d6..3a5e861b8b 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -3,7 +3,7 @@ name: Generate SBOM with Kubernetes BOM
 on:
   release:
     types:
-      - published
+      - released
 
 permissions:
   contents: read

From b6697e516611aa7e77d627af27d01c0ef98d6c58 Mon Sep 17 00:00:00 2001
From: Ricardo Lopes <ricardoapl.dev@gmail.com>
Date: Fri, 24 May 2024 09:18:22 +0100
Subject: [PATCH 4/4] ci: rename asset to pass CLOMonitor checks

Signed-off-by: Ricardo Lopes <ricardoapl.dev@gmail.com>
---
 .github/workflows/sbom.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 3a5e861b8b..ea82cb0125 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: write
 
     env:
-      OUTPUT: kube-state-metrics-${{ github.event.release.tag_name }}.spdx
+      OUTPUT: sbom.spdx
       TAG: ${{ github.event.release.tag_name }}
 
     steps: