Add SBOM generation workflows for docker, gradle and yarn

.github/workflows/sbom-docker.yml

@@ -0,0 +1,59 @@
+# Generates and uploads SBOMs for the published docker images (server, webui).
+name: Generate SBOM (docker image)
+
+on:
+  registry_package:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      image:
+        description: "Image on ghcr.io/eclipse-openvsx to scan"
+        required: true
+        type: choice
+        options:
+          - openvsx-server
+          - openvsx-webui
+      version:
+        description: "Version tag (e.g. v1.2.3)"
+        required: true
+
+permissions:
+  id-token: write  # required for OIDC-authenticated SBOM upload
+
+env:
+  REGISTRY: ghcr.io
+  OWNER: eclipse-openvsx
+  NAME: "${{ inputs.image || github.event.registry_package.name }}"
+  VERSION: "${{ inputs.version || github.event.registry_package.package_version.container_metadata.tag.name }}"
+
+jobs:
+  sbom-docker:
+    # * Auto-run only triggers in upstream repo for upstream registry images.
+    #   Known snapshot images are skipped (see main.yml). An unexpected image
+    #   name is left to fail in the Upload SBOM step, whose endpoint only
+    #   accepts registered product names.
+    # * Manual dispatch is allowed on forks, but also uses upstream registry
+    #   images. Image names are restricted by the input field.
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.repository_owner == 'eclipse-openvsx' &&
+       github.event.registry_package.name != 'openvsx-server-snapshot' &&
+       github.event.registry_package.name != 'openvsx-webui-snapshot')
+    runs-on: ubuntu-latest
+    steps:
+    - name: Generate SBOM
+      uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
+      with:
+        image: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ env.NAME }}:${{ env.VERSION }}
+        output-file: sbom.json
+        format: cyclonedx-json
+        upload-artifact: false
+
+    - name: Upload SBOM
+      uses: eclipse-csi/workflows/upload-sbom@a5993190de939557abd37e9d7a7ecfee80660876
+      with:
+        sbom-file: sbom.json
+        # NOTE: Upload will fail for a non-registered 'product-name'.
+        # See https://github.com/eclipse-csi/workflows#upload-sbom for details.
+        product-name: "${{ env.NAME }} docker image"
+        product-version: ${{ env.VERSION }}

.github/workflows/sbom-gradle.yml

@@ -0,0 +1,71 @@
+# Generates and uploads the SBOM for the gradle-based server component.
+name: Generate SBOM (server gradle)
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag (e.g. v1.2.3)"
+        required: true
+
+permissions:
+  id-token: write  # required for OIDC-authenticated SBOM upload
+
+
+env:
+  VERSION: "${{ inputs.version || github.ref_name }}"
+
+jobs:
+  sbom-server-gradle:
+    runs-on: ubuntu-latest
+    steps:
+    # Checkout project into subdirectory (path avoids collision with the tool).
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        ref: ${{ env.VERSION }}
+        path: source
+        persist-credentials: false
+
+    - name: Set up JDK
+      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+      with:
+        distribution: 'temurin'
+        java-version: 25
+
+    - name: Generate SBOM
+      run: |
+        # Enable CycloneDX plugin on the fly via init script. This leaves
+        # project gradle config untouched, and allows backfilling sboms for
+        # older project checkouts using workflow_dispatch.
+
+        # Generate init script
+        # see https://github.com/CycloneDX/cyclonedx-gradle-plugin?tab=readme-ov-file#usage-with-initialization-script
+
+        cat > /tmp/cyclonedx-init.gradle.kts << 'EOF'
+          import org.cyclonedx.gradle.CyclonedxPlugin
+
+          initscript {
+              repositories { gradlePluginPortal() }
+              dependencies {
+                  classpath("org.cyclonedx:cyclonedx-gradle-plugin:3.2.0")
+              }
+          }
+          rootProject {
+              apply<CyclonedxPlugin>()
+          }
+        EOF
+
+        # Generate aggregate SBOM
+        source/server/gradlew --no-daemon --init-script /tmp/cyclonedx-init.gradle.kts -p source/server cyclonedxBom
+
+    - name: Upload SBOM
+      uses: eclipse-csi/workflows/upload-sbom@a5993190de939557abd37e9d7a7ecfee80660876
+      with:
+        sbom-file: source/server/build/reports/cyclonedx/bom.json
+        # NOTE: Upload will fail for a non-registered 'product-name'.
+        # See https://github.com/eclipse-csi/workflows#upload-sbom for details.
+        product-name: "openvsx-server"
+        product-version: ${{ env.VERSION }}

.github/workflows/sbom-yarn.yml

@@ -0,0 +1,79 @@
+# Generates and uploads SBOMs for the yarn-based components (cli, webui).
+name: Generate SBOM (yarn)
+
+on:
+  push:
+    tags:
+      - 'cli-*'
+      - 'webui-*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. cli-1.2.3 or webui-1.2.3)"
+        required: true
+        type: string
+
+permissions:
+  id-token: write  # required for OIDC-authenticated SBOM upload
+
+
+env:
+  # Component is derived from the tag prefix (cli-* or webui-*) and drives the
+  # working directory (source/<component>) and product name (openvsx-<component>).
+  # Resolves to an empty string for an unrecognised tag (only possible via
+  # workflow_dispatch); the "Validate tag" step below rejects that case.
+  TAG: "${{ inputs.tag || github.ref_name }}"
+  COMPONENT: "${{ (startsWith(inputs.tag || github.ref_name, 'cli-') && 'cli') || (startsWith(inputs.tag || github.ref_name, 'webui-') && 'webui') || '' }}"
+  CYCLONEDX_YARN_PLUGIN_VERSION: "3.2.1"
+
+jobs:
+  sbom-yarn:
+    runs-on: ubuntu-latest
+    steps:
+    # Fail fast on a manually dispatched tag that names no known component
+    # (push is already restricted to cli-*/webui-* tags).
+    - name: Validate tag
+      run: |
+        if [ -z "${COMPONENT}" ]; then
+          echo "::error::Tag '${TAG}' must start with 'cli-' or 'webui-'"
+          exit 1
+        fi
+
+    # Checkout project into subdirectory (path avoids collision with the tool).
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        ref: ${{ env.TAG }}
+        path: source
+        persist-credentials: false
+
+    - name: Setup Node.js
+      uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+      with:
+        node-version: '24.x'
+        package-manager-cache: false
+        registry-url: 'https://registry.npmjs.org'
+
+    - name: Enable Corepack (Yarn Berry)
+      working-directory: source/${{ env.COMPONENT }}
+      run: corepack enable
+
+    - name: Install dependencies
+      working-directory: source/${{ env.COMPONENT }}
+      run: yarn install --immutable
+
+    - name: Generate SBOM
+      working-directory: source/${{ env.COMPONENT }}
+      run: |
+        yarn dlx -q @cyclonedx/yarn-plugin-cyclonedx@${CYCLONEDX_YARN_PLUGIN_VERSION} \
+          --output-format JSON \
+          --output-file bom.json \
+          --production
+
+    - name: Upload SBOM
+      uses: eclipse-csi/workflows/upload-sbom@a5993190de939557abd37e9d7a7ecfee80660876
+      with:
+        sbom-file: source/${{ env.COMPONENT }}/bom.json
+        # NOTE: Upload will fail for a non-registered 'product-name'.
+        # See https://github.com/eclipse-csi/workflows#upload-sbom for details.
+        product-name: openvsx-${{ env.COMPONENT }}
+        product-version: ${{ env.TAG }}