build(goreleaser): use native sboms feature

Signed-off-by: nscuro <[email protected]>

.github/workflows/goreleaser.yml

@@ -23,11 +23,10 @@ jobs:
       with:
         go-version: "1.17"
         check-latest: true
-    - name: Generate SBOM
+    - name: Install cyclonedx-gomod
       uses: CycloneDX/gh-gomod-generate-sbom@v1
       with:
         version: v1
-        args: mod -licenses -json -output bom.json -type library -verbose
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v2
       with:

.goreleaser.yml

@@ -1,32 +1,44 @@
 builds:
-  # This is a library project, we don't want to build any binaries.
-  # Building and testing is performed in the CI workflow
-  - skip: true
+# This is a library project, we don't want to build any binaries.
+# Building and testing is performed in the CI workflow
+- skip: true
+
 release:
-  extra_files:
-    - glob: ./bom.json
+  prerelease: auto
+
+source:
+  enabled: true
+
+sboms:
+- artifacts: source
+  documents:
+  - "${artifact}.cdx.sbom"
+  cmd: cyclonedx-gomod
+  args: [ "mod", "-licenses", "-json", "-output", "$document", "./.." ]
+
 milestones:
-  - name_template: "{{ .Tag }}"
-    close: true
+- name_template: "{{ .Tag }}"
+  close: true
+
 changelog:
   use: github
   sort: asc
   groups:
-    - title: Features
-      regexp: "^.*feat[(\\w)]*:+.*$"
-      order: 0
-    - title: Fixes
-      regexp: "^.*fix[(\\w)]*:+.*$"
-      order: 1
-    - title: Building and Packaging
-      regexp: "^.*build[(\\w)]*:+.*$"
-      order: 2
-    - title: Documentation
-      regexp: "^.*docs[(\\w)]*:+.*$"
-      order: 3
-    - title: Others
-      order: 999
+  - title: Features
+    regexp: "^.*feat[(\\w)]*:+.*$"
+    order: 0
+  - title: Fixes
+    regexp: "^.*fix[(\\w)]*:+.*$"
+    order: 1
+  - title: Building and Packaging
+    regexp: "^.*build[(\\w)]*:+.*$"
+    order: 2
+  - title: Documentation
+    regexp: "^.*docs[(\\w)]*:+.*$"
+    order: 3
+  - title: Others
+    order: 999
   filters:
     exclude:
-      - '^test:'
-      - '^Merge '
+    - '^test:'
+    - '^Merge '