Fix SBOM schema validation

.github/workflows/schemas.yml

@@ -0,0 +1,91 @@
+name: Update schema data
+on:
+  push:
+    paths:
+      - .github/workflows/schemas.yml
+    branches-ignore:
+      - master
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  spdx:
+    if: github.repository == 'Homebrew/brew'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+        with:
+          core: false
+          cask: false
+          test-bot: false
+
+      - name: Configure Git user
+        uses: Homebrew/actions/git-user-config@master
+        with:
+          username: BrewTestBot
+
+      - name: Set up commit signing
+        uses: Homebrew/actions/setup-commit-signing@master
+        with:
+          signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
+
+      - name: Update schema data
+        id: update
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
+          HOMEBREW_GPG_PASSPHRASE: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY_PASSPHRASE }}
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+        run: |
+          git fetch origin
+
+          BRANCH="schema-update"
+          echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
+
+          if git ls-remote --exit-code --heads origin "${BRANCH}"
+          then
+            git checkout "${BRANCH}"
+            git checkout "Library/Homebrew/data/schemas"
+          else
+            git checkout --no-track -B "${BRANCH}" origin/master
+          fi
+
+          # Intentionally tracking 2.3.x to match what we output in sbom.rb. 3.0 also doesn't have a JSON Schema.
+          # Note: this is a 2.3.1 development branch - not a 2.3.1 tag. It contains bugfixes compared to 2.3.0.
+          curl --location --output Library/Homebrew/data/schemas/sbom.json https://raw.githubusercontent.com/spdx/spdx-spec/development/v2.3.1/schemas/spdx-schema.json
+          # https://github.com/spdx/spdx-spec/pull/1029
+          sed -i -e 's|\(2019-09/schema\)#|\1|' Library/Homebrew/data/schemas/sbom.json
+
+          if ! git diff --exit-code Library/Homebrew/data/schemas
+          then
+            git add "Library/Homebrew/data/schemas"
+            git commit -m "data/schemas: update schema data." -m "Autogenerated by [a scheduled GitHub Action](https://github.com/Homebrew/brew/blob/master/.github/workflows/schemas.yml)."
+            echo "committed=true" >> "$GITHUB_OUTPUT"
+            PULL_REQUEST_STATE="$(gh pr view --json=state | jq -r ".state")"
+            if [[ "${PULL_REQUEST_STATE}" != "OPEN" ]]
+            then
+              echo "pull_request=true" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+      - name: Push commits
+        if: steps.update.outputs.committed == 'true'
+        uses: Homebrew/actions/git-try-push@master
+        with:
+          token: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
+          directory: ${{ steps.set-up-homebrew.outputs.repository-path }}
+          branch: ${{ steps.update.outputs.branch }}
+          force: true
+          origin_branch: "master"
+
+      - name: Open a pull request
+        if: steps.update.outputs.pull_request == 'true'
+        run: gh pr create --fill
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_PUBLIC_REPO_TOKEN }}
+        working-directory: ${{ steps.set-up-homebrew.outputs.repository-path }}