generate sbom

Author: bakito

.goreleaser.yml

@@ -27,3 +27,5 @@ changelog:
     exclude:
       - '^docs:'
       - '^test:'
+sboms:
+  - artifacts: archive

.toolbox.mk

@@ -16,6 +16,7 @@ TB_GINKGO ?= $(TB_LOCALBIN)/ginkgo
 TB_GOLANGCI_LINT ?= $(TB_LOCALBIN)/golangci-lint
 TB_GORELEASER ?= $(TB_LOCALBIN)/goreleaser
 TB_SEMVER ?= $(TB_LOCALBIN)/semver
+TB_SYFT ?= $(TB_LOCALBIN)/syft
 
 ## Tool Versions
 # renovate: packageName=github.com/golangci/golangci-lint/v2
@@ -27,6 +28,9 @@ TB_GORELEASER_VERSION_NUM ?= $(call STRIP_V,$(TB_GORELEASER_VERSION))
 # renovate: packageName=github.com/bakito/semver
 TB_SEMVER_VERSION ?= v1.1.7
 TB_SEMVER_VERSION_NUM ?= $(call STRIP_V,$(TB_SEMVER_VERSION))
+# renovate: packageName=github.com/anchore/syft/cmd/syft
+TB_SYFT_VERSION ?= v1.36.0
+TB_SYFT_VERSION_NUM ?= $(call STRIP_V,$(TB_SYFT_VERSION))
 
 ## Tool Installer
 .PHONY: tb.ginkgo
@@ -45,6 +49,10 @@ tb.goreleaser: ## Download goreleaser locally if necessary.
 tb.semver: ## Download semver locally if necessary.
 	@test -s $(TB_SEMVER) && $(TB_SEMVER) -version | grep -q $(TB_SEMVER_VERSION_NUM) || \
 		GOBIN=$(TB_LOCALBIN) go install github.com/bakito/semver@$(TB_SEMVER_VERSION)
+.PHONY: tb.syft
+tb.syft: ## Download syft locally if necessary.
+	@test -s $(TB_SYFT) && $(TB_SYFT) --version | grep -q $(TB_SYFT_VERSION_NUM) || \
+		GOBIN=$(TB_LOCALBIN) go install github.com/anchore/syft/cmd/syft@$(TB_SYFT_VERSION)
 
 ## Reset Tools
 .PHONY: tb.reset
@@ -53,13 +61,15 @@ tb.reset:
 		$(TB_GINKGO) \
 		$(TB_GOLANGCI_LINT) \
 		$(TB_GORELEASER) \
-		$(TB_SEMVER)
+		$(TB_SEMVER) \
+		$(TB_SYFT)
 
 ## Update Tools
 .PHONY: tb.update
 tb.update: tb.reset
 	toolbox makefile --renovate -f $(TB_LOCALDIR)/Makefile \
 		github.com/golangci/golangci-lint/v2/cmd/golangci-lint?--version \
 		github.com/goreleaser/goreleaser/v2?--version \
-		github.com/bakito/semver?-version
+		github.com/bakito/semver?-version \
+		github.com/anchore/syft/cmd/syft?--version
 ## toolbox - end

Makefile

@@ -13,10 +13,10 @@ tidy:
 test: tb.ginkgo
 	$(TB_GINKGO) -r --cover --coverprofile=coverage.out
 
-release: tb.goreleaser tb.semver
+release: tb.goreleaser tb.semver tb.syft
 	@version=$$($(TB_SEMVER)); \
 	git tag -s $$version -m"Release $$version"
-	$(TB_GORELEASER) --clean
+	PATH=$(TB_LOCALBIN):$${PATH} $(TB_GORELEASER) --clean
 
-test-release: tb.goreleaser
-	$(TB_GORELEASER) --skip=publish --snapshot --clean
+test-release: tb.goreleaser tb.syft
+	PATH=$(TB_LOCALBIN):$${PATH} $(TB_GORELEASER) --skip=publish --snapshot --clean