Initial commit after 79 trial and error. Mostly errors.

.gitattributes

@@ -0,0 +1,5 @@
+# Taken from https://github.com/actions/javascript-action/blob/9acd878b075d695cbef9bbd4885a1e7276bd97bb/.gitattributes
+
+* text=auto eol=lf
+
+dist/** -diff linguist-generated=true

.github/codeql/codeql-config.yml

@@ -0,0 +1,6 @@
+# Take from https://github.com/actions/javascript-action/blob/9acd878b075d695cbef9bbd4885a1e7276bd97bb/.github/codeql/codeql-config.yml
+name: JavaScript CodeQL Configuration
+
+paths-ignore:
+  - node_modules
+  - dist

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/check-dist.yml

@@ -0,0 +1,64 @@
+# Taken from https://github.com/actions/javascript-action/blob/9acd878b075d695cbef9bbd4885a1e7276bd97bb/.github/workflows/check-dist.yml
+name: Check Transpiled JavaScript
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check-dist:
+    name: Check dist/
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        id: setup-node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .tool-versions
+          cache: npm
+
+      - name: Install Dependencies
+        id: install
+        run: npm ci
+
+      - name: Build dist/ Directory
+        id: build
+        run: npm run bundle
+
+      # This will fail the workflow if the `dist/` directory is different than
+      # expected.
+      - name: Compare Directories
+        id: diff
+        run: |
+          if [ ! -d dist/ ]; then
+            echo "Expected dist/ directory does not exist.  See status below:"
+            ls -la ./
+            exit 1
+          fi
+          if [ "$(git diff --ignore-space-at-eol --text dist/ | wc -l)" -gt "0" ]; then
+            echo "Detected uncommitted changes after build. See status below:"
+            git diff --ignore-space-at-eol --text dist/
+            exit 1
+          fi
+
+      # If `dist/` was different than expected, upload the expected version as a
+      # workflow artifact.
+      - if: ${{ failure() && steps.diff.outcome == 'failure' }}
+        name: Upload Artifact
+        id: upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

.gitignore

@@ -0,0 +1,105 @@
+# Taken from https://github.com/actions/javascript-action/blob/9acd878b075d695cbef9bbd4885a1e7276bd97bb/.gitignore
+
+# Dependency directory
+node_modules
+
+# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+.env.test
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# OS metadata
+.DS_Store
+Thumbs.db
+
+# Ignore built ts files
+__tests__/runner/*
+
+# IDE files
+.idea
+.vscode
+*.code-workspace

.tool-versions

@@ -0,0 +1 @@
+nodejs 20.17.0

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Typist Tech Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,47 @@
+<div align="center">
+
+# Upload GoReleaser SBOMs
+
+</div>
+
+<div align="center">
+
+[![Check Transpiled JavaScript](https://github.com/typisttech/upload-goreleaser-sboms-action/actions/workflows/check-dist.yml/badge.svg)](https://github.com/typisttech/upload-goreleaser-sboms-action/actions/workflows/check-dist.yml)
+[![GitHub Release](https://img.shields.io/github/v/release/typisttech/upload-goreleaser-sboms-action?style=flat-square&)](https://github.com/typisttech/upload-goreleaser-sboms-action/releases/latest)
+[![GitHub Marketplace](https://img.shields.io/badge/marketplace-upload--goreleaser--sbom-blue?logo=github&style=flat-square)](https://github.com/marketplace/actions/upload-goreleaser-sboms)
+[![license](https://img.shields.io/github/license/typisttech/upload-goreleaser-sboms-action.svg?style=flat-square)](https://github.com/typisttech/upload-goreleaser-sboms-action/blob/master/LICENSE)
+[![X Follow @TangRufus](https://img.shields.io/badge/Follow-%40TangRufus-black?style=flat-square&logo=x&logoColor=white)](https://x.com/tangrufus)
+[![Hire Typist Tech](https://img.shields.io/badge/Hire-Typist%20Tech-ff69b4.svg?style=flat-square)](https://typist.tech/contact/)
+
+</div>
+
+<p align="center">
+  <strong>Upload GoReleaser-generated SBOMs as an artifact.</strong>
+  <br />
+  <br />
+  Built with ♥ by <a href="https://typist.tech/">Typist Tech</a>
+</p>
+
+---
+
+## Usage
+
+TODO.
+
+## Known Issues
+
+TODO.
+
+## Credits
+
+[Upload GoReleaser SBOMs](https://github.com/typisttech/upload-goreleaser-sboms-action) is a [Typist Tech](https://typist.tech) project and maintained by [Tang Rufus](https://x.com/TangRufus), freelance developer for [hire](https://typist.tech/contact/).
+
+Full list of contributors can be found [here](https://github.com/typisttech/upload-goreleaser-sboms-action/graphs/contributors).
+
+## Copyright and License
+
+This project is a [free software](https://www.gnu.org/philosophy/free-sw.en.html) distributed under the terms of the MIT license. For the full license, see [LICENSE](./LICENSE).
+
+## Contribute
+
+Feedbacks / bug reports / pull requests are welcome.

action.yml

@@ -0,0 +1,52 @@
+name: Upload GoReleaser SBOMs
+description: Upload GoReleaser-generated SBOMs as an artifact
+
+author: Typist Tech Limited
+branding:
+  icon: 'upload'
+  color: 'black'
+
+inputs:
+  dist:
+    description: 'Path to the dist folder which containing artifacts.json'
+    required: true
+    default: 'dist'
+  sbom-suffix:
+    description: 'SBOM suffix'
+    required: true
+    default: '.sbom.json'
+  artifact:
+    description: 'Artifact name'
+    required: true
+    default: 'sboms'
+  retention-days:
+    description: >
+      Duration after which artifact will expire in days. 0 means using default retention.
+
+      Minimum 1 day.
+      Maximum 90 days unless changed from the repository settings page.
+    required: true
+    default: '0'
+  compression-level:
+    description: >
+      The level of compression for Zlib to be applied to the artifact archive.
+      The value can range from 0 to 9:
+      - 0: No compression
+      - 1: Best speed
+      - 6: Default compression (same as GNU Gzip)
+      - 9: Best compression
+      Higher levels will result in better compression, but will take longer to complete.
+      For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+    default: '6'
+
+outputs:
+  attestations:
+    description: 'Pairs of SBOM and its subject'
+  artifact-id:
+    description: >
+      A unique identifier for the artifact that was just uploaded. Empty if the artifact upload failed.
+
+      This ID can be used as input to other APIs to download, delete or get more information about an artifact: https://docs.github.com/en/rest/actions/artifacts
+runs:
+  using: 'node20'
+  main: 'dist/index.js'