image: atlassian/default-image:latest  # or a smaller image like alpine

pipelines:
  default:
    - step:
        name: "Generate & Export SBOM"
        script:
          # Install Syft (if not using Docker)
          - curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
          # Generate SBOM (choose one format)
          - syft dir:. -o spdx-json=sbom.json  # SPDX format
          # - syft dir:. -o cyclonedx-json=sbom.cdx.json  # CycloneDX format
        artifacts:
          - sbom.json  # or sbom.cdx.json