(camel) branch main updated: ci: generate SBOM for active LTS branches (4.22.x, 4.18.x) (#26466)

[acosentino]

This is an automated email from the ASF dual-hosted git repository.

oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/main by this push:
     new e6df68db324b ci: generate SBOM for active LTS branches (4.22.x, 
4.18.x) (#26466)
e6df68db324b is described below

commit e6df68db324bae9c781d7b025a7616d38de3b5c7
Author: Andrea Cosentino <anco...@gmail.com>
AuthorDate: Tue Sep 15 12:26:49 2026 +0200

    ci: generate SBOM for active LTS branches (4.22.x, 4.18.x) (#26466)
    
    Adds a workflow to generate the CycloneDX SBOM for the active LTS 
maintenance branches (4.22.x, 4.18.x),
    alongside main, and documents it in the CI architecture notes.
    
    Co-authored-by: Claude Opus 4.8 <nore...@anthropic.com>
---
 .github/CI-ARCHITECTURE.md                         |  2 +-
 .../{generate-sbom-main.yml => generate-sbom.yml}  | 29 ++++++++++++++--------
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/.github/CI-ARCHITECTURE.md b/.github/CI-ARCHITECTURE.md
index 22acc2a1a3a5..9c95094f0f63 100644
--- a/.github/CI-ARCHITECTURE.md
+++ b/.github/CI-ARCHITECTURE.md
@@ -80,7 +80,7 @@ PR comment: /component-test kafka http
 - `pr-cleanup-branches.yml` — Cleans up merged PR branches
 - `alternative-os-build-main.yml` — Tests on non-Linux OSes
 - `check-container-versions.yml` — Checks test container version updates
-- `generate-sbom-main.yml` — Generates SBOM for releases
+- `generate-sbom.yml` — Regenerates the CycloneDX SBOM (`camel-sbom/`) for 
`main` and each active LTS branch (matrix), opening a PR per branch
 - `security-scan.yml` — Security vulnerability scanning
 
 ## Actions
diff --git a/.github/workflows/generate-sbom-main.yml 
b/.github/workflows/generate-sbom.yml
similarity index 69%
rename from .github/workflows/generate-sbom-main.yml
rename to .github/workflows/generate-sbom.yml
index 0ce2be2c0f85..a7204e499629 100644
--- a/.github/workflows/generate-sbom-main.yml
+++ b/.github/workflows/generate-sbom.yml
@@ -17,9 +17,14 @@
 
 name: Generate SBOM
 
+# This workflow lives on the default branch (main) only. GitHub fires the
+# `schedule` trigger from the default branch alone, so a single copy here can
+# regenerate the SBOM for main and for every active LTS maintenance branch by
+# checking each one out in turn (matrix.branch) and opening a PR back against 
it.
+# When an LTS line goes EOL, remove it from the matrix below.
 on:
   schedule:
-    # Every 24 hours
+    # Every Sunday at 14:30 UTC
   - cron: '30 14 * * 0'
   workflow_dispatch:
 
@@ -33,19 +38,21 @@ jobs:
 
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        java: [ '21' ]
+        branch: [ 'main', 'camel-4.22.x', 'camel-4.18.x' ]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 
v7.0.1
         with:
+          ref: ${{ matrix.branch }}
           persist-credentials: false
       - id: install-mvnd
         uses: ./.github/actions/install-mvnd
-      - name: Set up JDK ${{ matrix.java }}
+      - name: Set up JDK 21
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # 
v6.0.1
         with:
           distribution: 'temurin'
-          java-version: ${{ matrix.java }}
+          java-version: '21'
           cache: 'maven'
       - name: mvn build and sbom generation
         run: ./mvnw -B -l build.log -Psbom -Dquickly verify
@@ -53,22 +60,22 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a 
# v7.0.1
         if: always()
         with:
-          name: build.log
+          name: build-${{ matrix.branch }}.log
           path: build.log
       - name: Create Pull Request
         uses: 
peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # 
v8.1.1
         with:
-          base: main
+          base: ${{ matrix.branch }}
           token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: "Regen SBOM from commit ${{ github.sha }}"
+          commit-message: "Regen SBOM for ${{ matrix.branch }}"
           committer: GitHub <nore...@github.com>
           author: ${{ github.actor }} <${{ github.actor 
}}@users.noreply.github.com>
           signoff: true
-          branch: regen_bot_sbom
-          title: "Generated sources regen for SBOM"
+          branch: regen_bot_sbom_${{ matrix.branch }}
+          title: "Generated sources regen for SBOM (${{ matrix.branch }})"
           body: |
-            Regen bot :robot: found some uncommitted changes after running 
build on :camel: `main` branch for generating SBOMs.
-            Please do not delete `regen_bot_sbom` branch after merge/rebase.
+            Regen bot :robot: found some uncommitted changes after running 
build on :camel: `${{ matrix.branch }}` branch for generating SBOMs.
+            Please do not delete `regen_bot_sbom_${{ matrix.branch }}` branch 
after merge/rebase.
           labels: |
             regen
             automated pr