[biisal]

What does this PR do?

Includes an SBOM (SPDX JSON) with every release.

• .goreleaser.yml: adds a sboms: section that generates a <artifact>.sbom.json for each release artifact, using Syft.
  • Binaries: the darwin universal, linux and windows agent binaries, plus the windows -task launcher.
  • Linux packages: the deb and rpm.
  • Source: the source tarball, with source.enabled: true added to produce it.
  • The binaries entry uses artifacts: binary, because the archives use formats: binary.
• .github/workflows/release.yml: adds an "Install Syft" step before "Run GoReleaser", using anchore/sbom-action/download-syft pinned to the v0.24.3 commit SHA.

The SBOMs are uploaded to the release as GoReleaser assets. They are not cosign-signed or attested yet.

Type of change

• Bug fix
• Enhancement
• Documentation

Testing

• Tested on macOS (version: 26.5.2)
• Binary runs without errors: ./stepsecurity-dev-machine-guard --verbose
• JSON output is valid: ./stepsecurity-dev-machine-guard --json | python3 -m json.tool
• No secrets or credentials included
• Lint passes: make lint
• Tests pass: make test

Also done:

• goreleaser check passes
• goreleaser release --snapshot --clean --skip=publish generated 12 .sbom.json files (all binaries, deb and rpm packages, and the source tarball)

Related Issues

Closes: #14

[swarit-stepsecurity]

Hey @biisal I see you have raised a bunch of PRs, first of all thanks for taking time to contribute to the repository and we appreciate it, however at this point, we are not acting on PRs from external community. So we won't be merging any of your PRs anytime soon.

Please feel free to raise issues though, you can raise bugs, request features, or suggest changes, that being said, I am going to close this PR.

Thanks, again! Have a good day.