Generate SPDX 3.0 SBOM as it's the newer standard

Author: turbobobbytraykov

.github/workflows/sbom.yml

@@ -58,6 +58,7 @@ jobs:
 
       # -b: the shipped artifact (nupkg) gets listed with its hash in the SBOM's files section
       # -bc: dependency detection scans the project dir (NuGet + npm)
+      # -mi SPDX:3.0: emit the SBOM in SPDX 3.0 format (output goes to _manifest/spdx_3.0)
       - name: Generate SBOM
         working-directory: .config/sbom-tool
         run: >
@@ -68,13 +69,14 @@ jobs:
           -pv ${{ env.PACKAGE_VERSION }}
           -ps Infragistics
           -nsb http://spdx.org/spdxdocs/IgniteUI.Blazor.GridLite
+          -mi SPDX:3.0
           -V Information
 
       - name: Verify SBOM
         run: |
           set -euo pipefail
-          test -s artifacts/_manifest/spdx_2.2/manifest.spdx.json
-          test -s artifacts/_manifest/spdx_2.2/manifest.spdx.json.sha256
+          test -s artifacts/_manifest/spdx_3.0/manifest.spdx.json
+          test -s artifacts/_manifest/spdx_3.0/manifest.spdx.json.sha256
           echo "SBOM generated successfully."
 
       - name: Upload NuGet package
@@ -88,8 +90,8 @@ jobs:
       - name: Upload SBOM files
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: sbom-spdx_2.2
-          path: artifacts/_manifest/spdx_2.2
+          name: sbom-spdx_3.0
+          path: artifacts/_manifest/spdx_3.0
           retention-days: 1
           if-no-files-found: error
 
@@ -104,15 +106,15 @@ jobs:
       - name: Download SBOM artifact
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
-          name: sbom-spdx_2.2
-          path: spdx_2.2
+          name: sbom-spdx_3.0
+          path: spdx_3.0
 
       - name: Attach SBOM to release
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          asset="IgniteUI.Blazor.GridLite.${TAG}.spdx_2.2.zip"
-          (cd spdx_2.2 && zip -r "../${asset}" .)
+          asset="IgniteUI.Blazor.GridLite.${TAG}.spdx_3.0.zip"
+          (cd spdx_3.0 && zip -r "../${asset}" .)
           gh release upload "$TAG" "$asset" --clobber -R "${{ github.repository }}"