ci: add dependency submission GitHub Actions workflow

.github/workflows/dependency-submission.yml

@@ -0,0 +1,72 @@
+name: Dependency Submission & SBOM
+
+on:
+  push:
+    branches: [ "master" ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  sbom-dependency-submission:
+    name: SBOM & Dependency Submission (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - misp-core
+          - misp-modules
+          - misp-guard
+          - misp-nginx
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Initialize environment
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: |
+          sed -e '/^[[:space:]]*$/d' -e '/[#@]/d' -e 's/\"//g' -e 's/\(^[^=]*\)=\(.*\)/\1="\2"/' template.env > env.hcl
+          echo "COMMIT_HASH=$(echo '${{ github.sha }}' | cut -c 1-7)" >> "$GITHUB_ENV"
+          echo "NAMESPACE=local" >> "$GITHUB_ENV"
+
+      - name: Build and load image into Docker daemon
+        uses: docker/bake-action@v7
+        with:
+          source: .
+          push: false
+          load: true
+          provenance: false
+          files: docker-bake.hcl, env.hcl
+          targets: ${{ matrix.target }}
+          set: |
+            *.platform=linux/amd64
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          image: "local/${{ matrix.target }}:latest"
+          format: "spdx-json"
+          output-file: "sbom-${{ matrix.target }}.spdx.json"
+          dependency-snapshot: false
+
+      - name: Submit Dependency Snapshot to GitHub Dependency Graph
+        uses: advanced-security/spdx-dependency-submission-action@v0
+        with:
+          filePath: "sbom-${{ matrix.target }}.spdx.json"
+          correlator: "${{ github.job }}-${{ matrix.target }}"
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sbom-${{ matrix.target }}
+          path: sbom-${{ matrix.target }}.spdx.json
+          if-no-files-found: warn