From 8d8643a255258b1554cbe3805dc83094b3de8bd5 Mon Sep 17 00:00:00 2001
From: Diogo Rego <diego.arruda.amaral@gmail.com>
Date: Thu, 15 Oct 2026 13:54:53 +0000
Subject: [PATCH 1/3] ci: add dependency submission and sbom workflow

---
 .github/workflows/dependency-submission.yml | 64 +++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 00000000..59de9ed7
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,64 @@
+name: Dependency Submission & SBOM
+
+on:
+  push:
+    branches: [ "master" ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  sbom-dependency-submission:
+    name: SBOM & Dependency Submission (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - misp-core
+          - misp-modules
+          - misp-guard
+          - misp-nginx
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Initialize environment
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: |
+          sed -e '/^[[:space:]]*$/d' -e '/[#@]/d' -e 's/\"//g' -e 's/\(^[^=]*\)=\(.*\)/\1="\2"/' template.env > env.hcl
+          echo "COMMIT_HASH=$(echo '${{ github.sha }}' | cut -c 1-7)" >> "$GITHUB_ENV"
+          echo "NAMESPACE=local" >> "$GITHUB_ENV"
+
+      - name: Build and load image into Docker daemon
+        uses: docker/bake-action@v7
+        with:
+          source: .
+          push: false
+          load: true
+          provenance: false
+          files: docker-bake.hcl, env.hcl
+          targets: ${{ matrix.target }}
+          set: |
+            *.platform=linux/amd64
+
+      - name: Generate SBOM and submit Dependency Snapshot
+        uses: anchore/sbom-action@v0
+        with:
+          image: "local/${{ matrix.target }}:latest"
+          format: "spdx-json"
+          output-file: "sbom-${{ matrix.target }}.spdx.json"
+          dependency-snapshot: true
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-${{ matrix.target }}
+          path: sbom-${{ matrix.target }}.spdx.json
+          if-no-files-found: warn

From 408523a7f15f1de98c4e95e61ceabab60f6b0117 Mon Sep 17 00:00:00 2001
From: Diogo Rego <diego.arruda.amaral@gmail.com>
Date: Thu, 15 Oct 2026 14:27:54 +0000
Subject: [PATCH 2/3] Update upload-artifact action in dependency submission
 workflow

---
 .github/workflows/dependency-submission.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index 59de9ed7..cf42be6c 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -57,7 +57,7 @@ jobs:
           dependency-snapshot: true
 
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sbom-${{ matrix.target }}
           path: sbom-${{ matrix.target }}.spdx.json

From 341342495d4146bc751132454ce8a62f41a3bd7d Mon Sep 17 00:00:00 2001
From: Diogo Rego <diego.arruda.amaral@gmail.com>
Date: Thu, 15 Oct 2026 14:38:12 +0000
Subject: [PATCH 3/3] fix(ci): use unique correlator per matrix target to
 prevent dependency snapshot overwrite

---
 .github/workflows/dependency-submission.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index cf42be6c..d5448d7c 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   sbom-dependency-submission:
@@ -48,13 +49,20 @@ jobs:
           set: |
             *.platform=linux/amd64
 
-      - name: Generate SBOM and submit Dependency Snapshot
+      - name: Generate SBOM
         uses: anchore/sbom-action@v0
         with:
           image: "local/${{ matrix.target }}:latest"
           format: "spdx-json"
           output-file: "sbom-${{ matrix.target }}.spdx.json"
-          dependency-snapshot: true
+          dependency-snapshot: false
+
+      - name: Submit Dependency Snapshot to GitHub Dependency Graph
+        uses: advanced-security/spdx-dependency-submission-action@v0
+        with:
+          filePath: "sbom-${{ matrix.target }}.spdx.json"
+          correlator: "${{ github.job }}-${{ matrix.target }}"
+          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SBOM artifact
         uses: actions/upload-artifact@v7