@plainconceptsplatform/workflows 0.4.33 → 0.5.1

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -1,171 +1,268 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-dotnet-next.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: "App: CI"
-
-on:
-  pull_request:
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
-  workflow_call:
-    secrets:
-      NPM_REGISTRY_TOKEN:
-        required: false
-
-env:
-  DOTNET_VERSION: "10.0.x"
-  NODE_VERSION: "22"
-  PNPM_VERSION: "10"
-  API_WORKING_DIRECTORY: apps/api
-  DOTNET_SOLUTION: Numa.slnx
-  UNIT_TEST_PROJECT: tests/Numa.UnitTests/Numa.UnitTests.csproj
-  PARITY_TEST_PROJECT: tests/Numa.ParityTests/Numa.ParityTests.csproj
-  INTEGRATION_TEST_PROJECT: tests/Numa.IntegrationTests/Numa.IntegrationTests.csproj
-  COVERAGE_SETTINGS: coverage.runsettings
-  COVERAGE_CHECK_COMMAND: node ../../scripts/check-coverage.mjs TestResults/merged/Cobertura.xml
-  MIGRATION_PROJECT: src/Numa.Infrastructure/Numa.Infrastructure.csproj
-  MIGRATION_STARTUP_PROJECT: src/Numa.Api/Numa.Api.csproj
-  SEED_PROJECT: src/Numa.Seed
-  PRIMARY_DATABASE: numa
-  DATA_LAYER_DATABASE: numa_dl
-  SQL_SA_PASSWORD: "YourStrong!Passw0rd"
-  SQL_PORT: "1433"
-  WEB_PACKAGE: "@numa/web"
-  NPM_REGISTRY_URL: "//npm.pkg.github.com/"
-  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
-  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
-  SBOM_ARTIFACT_NAME: numa-sbom.cyclonedx.json
-  MIGRATION_CONTEXT: NumaDbContext
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  api:
-    name: API (.NET)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 30
-    services:
-      sqlserver:
-        image: mcr.microsoft.com/mssql/server:2022-latest
-        env:
-          ACCEPT_EULA: "Y"
-          MSSQL_SA_PASSWORD: ${{ env.SQL_SA_PASSWORD }}
-        ports:
-          - ${{ env.SQL_PORT }}:1433
-        options: >-
-          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P '${{ env.SQL_SA_PASSWORD }}' -Q 'SELECT 1' -C || exit 1"
-          --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
-    defaults:
-      run:
-        working-directory: ${{ env.API_WORKING_DIRECTORY }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
-        with:
-          dotnet-version: ${{ env.DOTNET_VERSION }}
-      - name: Restore tools, solution, and build
-        run: |
-          dotnet tool restore
-          dotnet restore "$DOTNET_SOLUTION"
-          dotnet build "$DOTNET_SOLUTION" --no-restore -c Release
-      - name: Unit tests with coverage
-        run: dotnet test "$UNIT_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
-      - name: Parity tests
-        run: dotnet test "$PARITY_TEST_PROJECT" --no-build -c Release
-      - name: Create test databases
-        run: |
-          for database in "$PRIMARY_DATABASE" "$DATA_LAYER_DATABASE"; do
-            docker exec ${{ job.services.sqlserver.id }} /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SQL_SA_PASSWORD" -C -Q "IF DB_ID('$database') IS NULL CREATE DATABASE [$database];"
-          done
-      - name: Apply migrations and seed test data
-        env:
-          ConnectionStrings__Numa: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-          DataLayer__ConnectionString: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-          DATALAYER_SEED: "true"
-        run: |
-          dotnet ef database update -p "$MIGRATION_PROJECT" -s "$MIGRATION_STARTUP_PROJECT" --context "$MIGRATION_CONTEXT"
-          dotnet run --project "$SEED_PROJECT" --no-build -c Release
-      - name: Integration tests with coverage
-        env:
-          ConnectionStrings__Numa: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-          DataLayer__ConnectionString: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
-        run: dotnet test "$INTEGRATION_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
-      - name: Enforce merged coverage floor
-        run: |
-          dotnet tool install --global dotnet-reportgenerator-globaltool
-          reportgenerator -reports:"TestResults/**/coverage.cobertura.xml" -targetdir:TestResults/merged -reporttypes:Cobertura
-          bash -c "$COVERAGE_CHECK_COMMAND"
-
-  web:
-    name: Web (Next.js)
-    if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-          run_install: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - name: Configure optional private registry authentication
-        env:
-          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
-        run: |
-          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
-            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
-          fi
-      - run: pnpm install --frozen-lockfile
-      - name: Lint, test, verify boundaries, and build
-        run: |
-          pnpm --filter "$WEB_PACKAGE" run lint
-          pnpm --filter "$WEB_PACKAGE" run test
-          pnpm --filter "$WEB_PACKAGE" run lint:fsd
-          pnpm --filter "$WEB_PACKAGE" run build
-
-  secret-scan:
-    name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
-
-  deps-and-iac-scan:
-    name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scanners: vuln,misconfig,secret
-          severity: CRITICAL,HIGH
-          ignore-unfixed: true
-          exit-code: "1"
-          format: table
-
-  sast-scan:
-    name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
-
-  sbom:
-    name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
-        with:
-          format: cyclonedx-json
-          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-dotnet-next.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "App: CI"
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+  workflow_call:
+    secrets:
+      NPM_REGISTRY_TOKEN:
+        required: false
+
+env:
+  DOTNET_VERSION: "10.0.x"
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+  API_WORKING_DIRECTORY: apps/api
+  DOTNET_SOLUTION: App.slnx
+  UNIT_TEST_PROJECT: tests/App.UnitTests/App.UnitTests.csproj
+  PARITY_TEST_PROJECT: tests/App.ParityTests/App.ParityTests.csproj
+  INTEGRATION_TEST_PROJECT: tests/App.IntegrationTests/App.IntegrationTests.csproj
+  # Per-PR mutation gate. Stryker mutates only files changed since the PR base (--since),
+  # so a green unit suite that never actually pins behaviour fails here instead of shipping.
+  # dotnet-stryker is pinned in the api tools manifest (.config/dotnet-tools.json / dotnet-tools.json).
+  MUTATION_TARGET_PROJECT: src/App.Domain/App.Domain.csproj
+  MUTATION_TEST_PROJECT: tests/App.UnitTests/App.UnitTests.csproj
+  MUTATION_THRESHOLD: "60"
+  COVERAGE_SETTINGS: coverage.runsettings
+  COVERAGE_CHECK_COMMAND: node ../../scripts/check-coverage.mjs TestResults/merged/Cobertura.xml
+  MIGRATION_PROJECT: src/App.Infrastructure/App.Infrastructure.csproj
+  MIGRATION_STARTUP_PROJECT: src/App.Api/App.Api.csproj
+  SEED_PROJECT: src/App.Seed
+  PRIMARY_DATABASE: app
+  DATA_LAYER_DATABASE: numa_dl
+  SQL_SA_PASSWORD: "YourStrong!Passw0rd"
+  WEB_PACKAGE: "@app/web"
+  NPM_REGISTRY_URL: "//npm.pkg.github.com/"
+  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
+  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
+  SBOM_ARTIFACT_NAME: app-sbom.cyclonedx.json
+  MIGRATION_CONTEXT: AppDbContext
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  api:
+    name: API (.NET)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    timeout-minutes: 30
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        env:
+          ACCEPT_EULA: "Y"
+          MSSQL_SA_PASSWORD: ${{ env.SQL_SA_PASSWORD }}
+        ports:
+        # Ephemeral host port. Four runners share this machine, so a fixed 1433 means the
+        # second concurrent job fails at Initialize containers with "Docker start fail with
+        # exit code 1". Steps read the assigned port from the job.services context.
+          - 1433
+        options: >-
+          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P '${{ env.SQL_SA_PASSWORD }}' -Q 'SELECT 1' -C || exit 1"
+          --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
+    defaults:
+      run:
+        working-directory: ${{ env.API_WORKING_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+      - name: Restore tools, solution, and build
+        run: |
+          dotnet tool restore
+          dotnet restore "$DOTNET_SOLUTION"
+          dotnet build "$DOTNET_SOLUTION" --no-restore -c Release
+      - name: Unit tests with coverage
+        run: dotnet test "$UNIT_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
+      - name: Parity tests
+        run: dotnet test "$PARITY_TEST_PROJECT" --no-build -c Release
+      - name: Create test databases
+        run: |
+          for database in "$PRIMARY_DATABASE" "$DATA_LAYER_DATABASE"; do
+            docker exec ${{ job.services.sqlserver.id }} /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SQL_SA_PASSWORD" -C -Q "IF DB_ID('$database') IS NULL CREATE DATABASE [$database];"
+          done
+      - name: Apply migrations and seed test data
+        env:
+          ConnectionStrings__App: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DataLayer__ConnectionString: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DATALAYER_SEED: "true"
+        run: |
+          dotnet ef database update -p "$MIGRATION_PROJECT" -s "$MIGRATION_STARTUP_PROJECT" --context "$MIGRATION_CONTEXT"
+          dotnet run --project "$SEED_PROJECT" --no-build -c Release
+      - name: Integration tests with coverage
+        env:
+          ConnectionStrings__App: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DataLayer__ConnectionString: Server=localhost,${{ job.services.sqlserver.ports['1433'] }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+        run: dotnet test "$INTEGRATION_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
+      - name: Enforce merged coverage floor
+        run: |
+          dotnet tool install --global dotnet-reportgenerator-globaltool
+          export PATH="$PATH:$HOME/.dotnet/tools"   # ephemeral ARC runners do not have dotnet tools on PATH
+          reportgenerator -reports:"TestResults/**/coverage.cobertura.xml" -targetdir:TestResults/merged -reporttypes:Cobertura
+          bash -c "$COVERAGE_CHECK_COMMAND"
+
+  mutation-api:
+    name: Mutation (.NET, diff)
+    if: github.event_name == 'pull_request'
+    runs-on: agents-arc
+    timeout-minutes: 25
+    defaults:
+      run:
+        working-directory: ${{ env.API_WORKING_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Stryker --since diffs against the PR base; it needs history, not a shallow tip.
+          fetch-depth: 0
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+      - name: Detect backend changes
+        id: scope
+        working-directory: ${{ github.workspace }}
+        run: |
+          git fetch origin "$GITHUB_BASE_REF" --depth=1
+          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^${API_WORKING_DIRECTORY}/"; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No ${API_WORKING_DIRECTORY} changes in this PR; skipping .NET mutation."
+          fi
+      - name: Restore tools and build
+        if: steps.scope.outputs.run == 'true'
+        run: |
+          dotnet tool restore
+          dotnet build "$DOTNET_SOLUTION" -c Release
+      - name: Stryker.NET (changed files only)
+        if: steps.scope.outputs.run == 'true'
+        run: |
+          export PATH="$PATH:$HOME/.dotnet/tools"   # ephemeral ARC runners do not have dotnet tools on PATH
+          dotnet stryker \
+            --project "$MUTATION_TARGET_PROJECT" \
+            --test-projects "$MUTATION_TEST_PROJECT" \
+            --since:"origin/$GITHUB_BASE_REF" \
+            --concurrency 2 \
+            --threshold-high "$MUTATION_THRESHOLD" \
+            --threshold-low "$MUTATION_THRESHOLD" \
+            --break-at "$MUTATION_THRESHOLD" \
+            --reporter progress --reporter json
+
+  web:
+    name: Web (Next.js)
+    if: github.event_name != 'schedule'
+    runs-on: agents-arc
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Configure optional private registry authentication
+        env:
+          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+        run: |
+          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
+            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
+          fi
+      - run: pnpm install --frozen-lockfile
+      - name: Lint, test, verify boundaries, and build
+        run: |
+          pnpm --filter "$WEB_PACKAGE" run lint
+          pnpm --filter "$WEB_PACKAGE" run test
+          pnpm --filter "$WEB_PACKAGE" run lint:fsd
+          pnpm --filter "$WEB_PACKAGE" run build
+
+  mutation-web:
+    name: Mutation (web, diff)
+    if: github.event_name == 'pull_request'
+    runs-on: agents-arc
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Detect web changes
+        id: scope
+        run: |
+          git fetch origin "$GITHUB_BASE_REF" --depth=1
+          if git diff --name-only "origin/$GITHUB_BASE_REF" HEAD | grep -qE "^apps/web/"; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No apps/web changes in this PR; skipping web mutation."
+          fi
+      - name: Configure optional private registry authentication
+        if: steps.scope.outputs.run == 'true'
+        env:
+          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+        run: |
+          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
+            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
+          fi
+      - name: Install and run StrykerJS (changed files only)
+        if: steps.scope.outputs.run == 'true'
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm --filter "$WEB_PACKAGE" exec stryker run --since="origin/$GITHUB_BASE_REF"
+
+  secret-scan:
+    name: Secret scan (TruffleHog)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
+
+  deps-and-iac-scan:
+    name: Dependencies and IaC (Trivy)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig,secret
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  sast-scan:
+    name: SAST (Semgrep)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: agents-arc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}