fix: ensure sbom is copied to output-file

[gszr]

Before this, the sbom file would only be copied to output-file if upload-artifact is true. However, the file may still be useful if upload is not enabled.

[kzantow]

As it stands, this would break artifact upload functionality when output-file is unset.

Additionally, you need to generate the dist/* files (this should have happened automatically if you ran npm install, which would have installed a git hook to do this), but you can manually run this using npm run package.

I think you should revert all changes here except removal of:

const outputFile = core.getInput("output-file");
  if (outputFile) {
    fs.copyFileSync(filePath, outputFile);
  }

and addition of:

const outputFile = core.getInput("output-file");
    if (outputFile) {
        fs.writeFileSync(outputFile, contents);
    }

[gszr]

Thanks for reviewing / merging, @kzantow!

[zosocanuck]

The ability to specify an output-file seems to be broken:

- name: Create SBOM
        uses: anchore/sbom-action@v0.14.2
        with:
          image: ${{ env.IMAGE }}
          artifact-name: sample-image.spdx
          output-file: ${{ github.workspace }}/sample-image.spdx
          upload-artifact: true

SBOM scan completed in: 4.115s
------------------------- Uploading workflow artifacts -------------------------
/tmp/sbom-action-1zzfZv/sample-image.spdx

[kzantow]

@zosocanuck there is always a file output to a temp directory. If you add the output-file option, it's copied there. What happens if you add a step to ls, e.g.:

- run: ls -alF '${{ github.workspace }}/sample-image.spdx'

?