Generate SBOM (#655)

* Generate SBOM

* Update release.yml

* Update .github/workflows/release.yml

Co-authored-by: Matthieu MOREL <mmorel-35@users.noreply.github.com>

* Publish bom.json

* Ignore SBOMs generated during CI

Co-authored-by: Matthieu MOREL <mmorel-35@users.noreply.github.com>

.github/workflows/release.yml

@@ -21,6 +21,13 @@ jobs:
       - name : Get release version
         id: get_version
         run: echo ::set-env name=RELEASE_VERSION::$(echo ${GITHUB_REF:10})
+      - name: Generate SBOM
+        uses: CycloneDX/gh-gomod-generate-sbom@v0.2.0
+        with:
+          json: true
+          output: bom.json
+          resolve-licenses: true
+          version: latest
       - name: Release Binaries
         uses: goreleaser/goreleaser-action@v2
         with:

.gitignore

@@ -33,3 +33,6 @@ _testmain.go
 .DS_Store
 
 .vscode
+
+# SBOMs generated during CI
+/bom.json

.goreleaser.yml

@@ -2,6 +2,8 @@
 project_name: gosec
 
 release:
+  extra_files:
+    - glob: ./bom.json
   github:
     owner: securego
     name: gosec