fix(ci): generate-sbom – always checkout latest main, handle same-day reruns

[Copilot]

The generate-sbom workflow failed on same-day reruns because git push was rejected when the sbom/update-YYYY-MM-DD branch already existed on the remote. Additionally, the checkout used the triggering commit SHA rather than the HEAD of main, so concurrent or queued runs could generate SBOMs from a stale tree.

Changes

• Always pull latest main — add ref: main to actions/checkout@v4 so SBOM generation always reflects the current state of the default branch, not the specific triggering commit.
• Handle existing same-day branch — replace git push origin with git push --force origin so reruns on the same calendar day update the existing branch rather than erroring out.
• Skip duplicate PR creation — guard gh pr create with a pre-check; if a PR for the branch already exists the step is a no-op (the force-pushed commits are automatically reflected in the open PR).

- uses: actions/checkout@v4
  with:
    ref: main          # always latest, not the triggering commit SHA

# ...

git push --force origin "$BRANCH"

gh pr view "$BRANCH" > /dev/null 2>&1 || gh pr create \
  --title "chore: update SBOM inventory (${DATE})" \
  --body "..."

[sei-vsarvepalli]

This change is helpful lets do it.

[Copilot]

Pull request overview

This PR hardens the generate-sbom GitHub Actions workflow to make reruns idempotent and ensure SBOMs are generated from the latest main branch state rather than the triggering commit.

Changes:

• Check out main explicitly during the workflow run to avoid generating SBOMs from a stale commit when runs are queued/concurrent.
• Force-push the daily sbom/update-YYYY-MM-DD branch so same-day reruns update the existing branch instead of failing.
• Avoid failing on duplicate PR creation by only creating a PR when one doesn’t already exist for the branch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.