build: add .sbom for archive artifacts

circonus-labs · Nov 28, 2023 · 6aef5e0 · 6aef5e0
1 parent 31029c4
commit 6aef5e0
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/.goreleaser.yml b/.goreleaser.yml
@@ -85,3 +85,10 @@ checksum:
 
 snapshot:
   name_template: '{{ incpatch .Version }}-devel'
+
+sboms:
+  - artifacts: archive
+    args: ["$artifact", "--output", "cyclonedx-json@1.5=$document"]
+    env:
+      - SYFT_GOLANG_SEARCH_LOCAL_MOD_CACHE_LICENSES=true
+      - SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true