Improve SBOM generation

.github/workflows/sboms.yml

@@ -0,0 +1,70 @@
+# Generated by `sbomify-action wizard`. Re-run the wizard to update.
+# sbomify-action wizard v26.7.0
+name: sboms
+on:
+  push:
+    tags: ['v*', '[0-9]*']
+  workflow_dispatch:
+jobs:
+  sbom:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required to mint the GitHub OIDC JWT
+      contents: read
+      attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: cli
+            component_name: CLI
+            component_id: UUzAdk8ixV
+            lockfile: Cargo.lock
+            sbom_format: cyclonedx
+            output_file: cli.cdx.json
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+        with:
+          path: .sbomify-cache
+          key: sbomify-${{ runner.os }}
+      - id: ver
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "v=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+          else
+            echo "v=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          fi
+      - uses: sbomify/sbomify-action@ddf6a0d3d75b645153ad1ad60034b3fe2cb1eb63  # v26.7.0
+        env:
+          COMPONENT_ID: ${{ matrix.component_id }}
+          COMPONENT_NAME: ${{ matrix.component_name }}
+          COMPONENT_VERSION: ${{ steps.ver.outputs.v }}
+          LOCK_FILE: ${{ matrix.lockfile }}
+          UPLOAD: 'true'
+          AUGMENT: 'true'
+          ENRICH: 'true'
+          SBOM_FORMAT: ${{ matrix.sbom_format }}
+          OUTPUT_FILE: ${{ matrix.output_file }}
+          API_BASE_URL: https://app.sbomify.com
+          SBOMIFY_CACHE_DIR: ${{ github.workspace }}/.sbomify-cache
+          SYFT_CACHE_DIR: ${{ github.workspace }}/.sbomify-cache/syft
+          PRODUCT_RELEASE: '["44WZdk8ixV:${{ steps.ver.outputs.v }}"]'
+      # ---------------------------------------------------------------------
+      # Build-provenance attestation (SLSA v1)
+      # ---------------------------------------------------------------------
+      # Where this step is supported:
+      #   * Public repository on any GitHub plan (Free, Pro, Team, Enterprise)
+      #     — uses the public-good Sigstore instance (Fulcio + Rekor public log).
+      #   * Private / internal repository on GitHub Enterprise Cloud
+      #     — uses GitHub's private Sigstore instance (scoped to the repo).
+      # Where it is NOT supported and the workflow will fail:
+      #   * Private / internal repository on GitHub Free, Pro, or Team.
+      #   * Any repository on GitHub Enterprise Server (self-hosted).
+      # If you hit one of the unsupported configurations, either upgrade to
+      # GitHub Enterprise Cloud, make the repo public, or remove this step.
+      # Reference: https://github.com/actions/attest-build-provenance
+      - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        with:
+          subject-path: '${{ github.workspace }}/${{ matrix.output_file }}'