From 602a5e535474d41acecb67f3e44d7c839e84ddf5 Mon Sep 17 00:00:00 2001
From: Avisek <biisal.int@gmail.com>
Date: Fri, 23 Oct 2026 23:22:15 +0530
Subject: [PATCH] Generate enriched SPDX SBOMs for release artifacts

---
 .github/workflows/release.yml |  3 +++
 .goreleaser.yml               | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ade22a1..b1bf7081 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,6 +59,9 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
diff --git a/.goreleaser.yml b/.goreleaser.yml
index bb25eb65..deff85be 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -91,5 +91,27 @@ nfpms:
     bindir: /usr/local/bin
     file_name_template: "stepsecurity-dev-machine-guard-{{ .Version }}-{{ .Arch }}"
 
+source:
+  enabled: true
+
+sboms:
+  - id: binaries
+    artifacts: binary
+    documents:
+      - "{{ .ArtifactName }}.sbom.json"
+    args: ["$artifact", "--output", "spdx-json=$document", "--enrich", "all"]
+
+  - id: packages
+    artifacts: package
+    documents:
+      - "{{ .ArtifactName }}.sbom.json"
+    args: ["$artifact", "--output", "spdx-json=$document", "--enrich", "all"]
+
+  - id: source
+    artifacts: source
+    documents:
+      - "{{ .ArtifactName }}.sbom.json"
+    args: ["$artifact", "--output", "spdx-json=$document", "--enrich", "all"]
+
 release:
   draft: true