From becd51a393fe788deab18bbf8d949e45de5d65a2 Mon Sep 17 00:00:00 2001
From: Markus Opolka <markus.opolka@netways.de>
Date: Tue, 11 Aug 2026 16:10:23 +0200
Subject: [PATCH] Add SBOM to releases

---
 .github/workflows/build.yml | 3 +++
 .goreleaser.yml             | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d0b3890..cc2b45a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,6 +28,9 @@ jobs:
       - name: Build
         run: go build -v .
 
+      - name: Setup Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+
       - name: Run goreleaser in release mode
         if: success() && startsWith(github.ref, 'refs/tags/v')
         uses: goreleaser/goreleaser-action@v7
diff --git a/.goreleaser.yml b/.goreleaser.yml
index c07ae82..2f6a869 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -3,6 +3,9 @@ version: 2
 before:
   hooks:
     - go mod download
+sboms:
+  - artifacts: binary
+    args: ["$artifact", "--output", "cyclonedx-json=$document"]
 builds:
   - env:
       - CGO_ENABLED=0