# Add after your existing build, tests and compatible SBOM generation.
# Copy the reviewed tools/ci/upload-inventory.mjs into your repository first.
# Node.js 22+, Pro source, and its scoped CI upload token are required.
- name: Check inventory format locally
  run: node tools/ci/upload-inventory.mjs --check bom.json
- name: Upload maintenance inventory
  env:
    IIDY_UPLOAD_TOKEN: ${{ secrets.IIDY_UPLOAD_TOKEN }}
    IIDY_SOURCE_ID: ${{ vars.IIDY_SOURCE_ID }}
  run: node tools/ci/upload-inventory.mjs bom.json
# Keep your existing Dependency-Track upload and security gates separately.
# Upload success means accepted inventory, not a passed maintenance gate.