feat(ci): add sbom generation

Signed-off-by: Travis Truman <trumant@gmail.com>

Author: trumant

.github/workflows/release.yml

@@ -33,6 +33,10 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: 1.23.4
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b
+        with:
+          syft-version: v1.33.0
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
         with:
@@ -45,3 +49,8 @@ jobs:
         uses: actions/attest-build-provenance@v3
         with:
           subject-checksums: dist/checksums.txt
+      - name: Attest SBOMs
+        uses: actions/attest-sbom@v3
+        with:
+          subject-checksums: dist/checksums.txt
+          sbom-path: 'dist/pvtr-github-repo_*.tar.gz.spdx.json'

.goreleaser.yaml

@@ -48,5 +48,60 @@ checksum:
 release:
   prerelease: auto
 
+sboms:
+  - # ID of the sbom config, must be unique.
+    #
+    # Default: 'default'.
+    id: sboms
+
+    # List of names of the SBOM documents created at this step
+    # (relative to the dist dir).
+    #
+    # Each element configured is made available as variables. For example:
+    #   documents: ["foo", "bar"]
+    #
+    # would make the following variables that can be referenced as template keys:
+    #   document0: "foo"
+    #   document1: "bar"
+    #
+    # Note that multiple sbom values are only allowed if the value of
+    # "artifacts" is "any".
+    #
+    # Default:
+    #   When "binary":   ["{{ .Binary }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom.json"]
+    #   When "any":      []
+    #   Otherwise:       ["{{ .ArtifactName }}.sbom.json"]
+    # Templates: allowed.
+    documents:
+      - "${artifact}.spdx.json"
+
+    # Path to the SBOM generator command
+    #
+    # Note: the process CWD will be set to the same location as "dist"
+    #
+    # Default: 'syft'.
+    cmd: syft
+
+    # Command line arguments for the command
+    #
+    # Default: ["$artifact", "--output", "spdx-json=$document", "--enrich", "all"].
+    # Templates: allowed.
+    # args: ["$artifact", "--output", "cyclonedx-json=$document"]
+
+    # Which artifacts to catalog.
+    #
+    # Valid options are:
+    # - any:        let the SBOM tool decide which artifacts available in
+    #               the cwd should be cataloged
+    # - source:     source archive
+    # - package:    Linux packages (deb, rpm, apk, etc)
+    # - installer:  Windows MSI installers (Pro only)
+    # - diskimage:  macOS DMG disk images (Pro only)
+    # - archive:    archives from archive pipe
+    # - binary:     binaries output from the build stage
+    #
+    # Default: 'archive'.
+    artifacts: archive
+
 universal_binaries:
   - replace: true