From afc8e283e83a7d11992b31411f81e04bb4f64004 Mon Sep 17 00:00:00 2001
From: Tony Meyer <tony.meyer@canonical.com>
Date: Sat, 30 May 2026 21:19:08 +1200
Subject: [PATCH] ci: add SBOM and secscan workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds sbomber manifest and sbom-secscan workflow to scan the published
charm artifact on charmhub (2.x/stable, ubuntu@20.04). Runs on a
cycle-aligned schedule (10 April and October) and via workflow_dispatch.
No build step needed — sbomber fetches the charm directly from charmhub.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/.sbomber-manifest.yaml      | 28 ++++++++++++++++++++++++++++
 .github/workflows/sbom-secscan.yaml | 25 +++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/.sbomber-manifest.yaml
 create mode 100644 .github/workflows/sbom-secscan.yaml

diff --git a/.github/.sbomber-manifest.yaml b/.github/.sbomber-manifest.yaml
new file mode 100644
index 0000000..28fa058
--- /dev/null
+++ b/.github/.sbomber-manifest.yaml
@@ -0,0 +1,28 @@
+clients:
+  sbom:
+    service_url: https://sbom-request.canonical.com
+    department: charm_engineering
+    email: tony.meyer@canonical.com
+    team: charm_tech
+  secscan: {}
+
+artifacts:
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@18.04
+
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@20.04
+
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@22.04
+
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@24.04
diff --git a/.github/workflows/sbom-secscan.yaml b/.github/workflows/sbom-secscan.yaml
new file mode 100644
index 0000000..4c2469d
--- /dev/null
+++ b/.github/workflows/sbom-secscan.yaml
@@ -0,0 +1,25 @@
+name: SBOM and secscan
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run on the 10th of April and October, aligned to the Canonical release cycle.
+    - cron: "0 0 10 4,10 *"
+
+permissions: {}
+
+jobs:
+  scan:
+    name: SBOM and secscan
+    runs-on: [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: sbomber
+        uses: canonical/sbomber/.github/actions/run@cf7a76e810497ec932e8285b2c9d6b373d225e79  # main -- the sbomber-ref input below should match
+        with:
+          manifest: ${{ github.workspace }}/.github/.sbomber-manifest.yaml
+          artifact-name: secscan-report-upload
+          sbomber-ref: cf7a76e810497ec932e8285b2c9d6b373d225e79  # should match the ref in 'uses' above