Commit 8ee86fa3f for imagemagick.org

commit 8ee86fa3fe75b71f3c8f0b066a4525abecf17c25
Author: Dirk Lemstra <dirk@lemstra.org>
Date:   Sun Aug 23 16:49:46 2026 +0200

    Create an SBOM for the Windows release artifacts.

diff --git a/.github/build/windows/create-sbom.py b/.github/build/windows/create-sbom.py
new file mode 100644
index 000000000..ab1d3ea3c
--- /dev/null
+++ b/.github/build/windows/create-sbom.py
@@ -0,0 +1,24 @@
+import json
+import os
+import sys
+import uuid
+
+if len(sys.argv) != 2:
+    print("Usage: create-sbom.py <output>")
+    sys.exit(1)
+
+output_file = sys.argv[1]
+version = os.environ["VERSION"]
+timestamp = os.environ["TIMESTAMP"]
+
+with open("Artifacts/sbom.json", "r") as f:
+    sbom = json.load(f)
+
+sbom["serialNumber"] = "urn:uuid:" + str(uuid.uuid4())
+sbom["metadata"]["timestamp"] = timestamp
+sbom["metadata"]["component"]["version"] = version
+
+with open(output_file, "w") as f:
+    json.dump(sbom, f, indent=2)
+
+print(f"SBOM created: {output_file}")
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 80cbbe018..e066e119d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,7 @@ jobs:
     outputs:
       version: ${{steps.version.outputs.version}}
       semantic_version: ${{steps.version.outputs.semantic_version}}
+      timestamp: ${{steps.version.outputs.timestamp}}
       publish: ${{steps.version.outputs.publish}}

     steps:
@@ -46,6 +47,9 @@ jobs:
           echo "version=$version"
           echo "semantic_version=$semantic_version" >> $GITHUB_OUTPUT
           echo "semantic_version=$semantic_version"
+          timestamp=$(git log -1 --format=%cI)
+          echo "timestamp=$timestamp" >> $GITHUB_OUTPUT
+          echo "timestamp=$timestamp"
           tag=$(git describe --tags HEAD --exact-match || true)
           if [[ "$tag" == "$version" ]]; then
             echo "publish=true" >> $GITHUB_OUTPUT
@@ -205,6 +209,14 @@ jobs:
           directory: ${{ github.workspace }}\Configure\Installer\Inno\Artifacts
           files: '*.exe'

+      - name: Create SBOM
+        shell: cmd
+        env:
+          VERSION: ${{needs.version.outputs.version}}
+          TIMESTAMP: ${{needs.version.outputs.timestamp}}
+        run: |
+          python ImageMagick\.github\build\windows\create-sbom.py Configure\Installer\Inno\Artifacts\ImageMagick-%VERSION%-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.typeName}}-${{matrix.architecture}}.cdx.json
+
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: ImageMagick-${{needs.version.outputs.version}}-${{matrix.quantum}}${{matrix.hdri_flag}}-${{matrix.typeName}}-${{matrix.architecture}}.exe
@@ -635,6 +647,7 @@ jobs:
             ${{github.workspace}}/artifacts/*.exe \
             ${{github.workspace}}/artifacts/*.intoto.jsonl \
             ${{github.workspace}}/artifacts/*.msixbundle \
+            ${{github.workspace}}/artifacts/*.cdx.json \
             ${{github.workspace}}/artifacts/*.xz

   prepare_msix: