From 79172499618048d1b6bd6f04b11be71aff2e4b1d Mon Sep 17 00:00:00 2001
From: Lukas Puehringer <lukas.puehringer@eclipse-foundation.org>
Date: Tue, 15 Sep 2026 12:50:30 +0200
Subject: [PATCH] Authenticate SBOM uploads with PIA

Replace the `actions/upload-artifact` step and deprecated `store-sbom-data`
reusable-workflow job with the `upload-sbom` composite action, which
uploads the SBOM to DependencyTrack (sbom.eclipse.org) via PIA.

PIA authenticates the upload with OIDC, hence the added `id-token: write`
permission, and resolves the DependencyTrack project from
product-name/product-version, so the hard-coded parent project UUID is no
longer needed.

More at https://eclipse-csi.github.io/security-handbook/sbom/howto.html#how-to-upload-an-sbom-to-dependencytrack

Assisted-by: Claude:claude-opus-5
Signed-off-by: Lukas Puehringer <lukas.puehringer@eclipse-foundation.org>
---
 .github/workflows/generate-maven-sbom.yml | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/generate-maven-sbom.yml b/.github/workflows/generate-maven-sbom.yml
index 0b449abaf9..3f63dfbd86 100644
--- a/.github/workflows/generate-maven-sbom.yml
+++ b/.github/workflows/generate-maven-sbom.yml
@@ -23,8 +23,9 @@ permissions:
 jobs:
   generate-sbom:
     runs-on: ubuntu-latest
-    outputs:
-      project-version: ${{ steps.version.outputs.PROJECT_VERSION }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Extract version
         id: version
@@ -49,17 +50,8 @@ jobs:
           mvn org.cyclonedx:cyclonedx-maven-plugin:$PLUGIN_VERSION:$SBOM_TYPE -f "$PRODUCT_PATH/pom.xml"
 
       - name: Upload sbom
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: eclipse-csi/workflows/upload-sbom@20e3c63807b2bd61b7f1a9f438e5ce588c054efc # main
         with:
-          name: sbom
-          path: ${{ env.PRODUCT_PATH }}/target/bom.json
-  
-  store-sbom-data: # stores sbom and metadata in a predefined format for otterdog to pick up
-    needs: ['generate-sbom']
-    uses: eclipse-csi/workflows/.github/workflows/store-sbom-data.yml@main
-    with:
-      projectName: 'che-server'
-      projectVersion: ${{ needs.generate-sbom.outputs.project-version }}
-      bomArtifact: 'sbom'
-      bomFilename: 'bom.json'
-      parentProject: '1ab66138-685e-47bb-9020-feb6ca1fb40c'
+          sbom-file: ${{ env.PRODUCT_PATH }}/target/bom.json
+          product-name: 'che-server'
+          product-version: ${{ steps.version.outputs.PROJECT_VERSION }}