ci: generate sboms for provided packeges in a release

[y-eight]

Motivation

Goreleaser provides the functionality to generate the sbom when creating a GitHub release with its artifacts.

Changes

This MR will add sboms for all provided artifacts when a new release is created. This is needed to prepare the migration of the repo.

Edit: Additionally I have added a description how to use Syft manually in our context.

For additional information look at the commits.

Tests done

• Unit tests succeeded
• E2E tests succeeded

[puffitos]

LGTM but why is the syft installation needed in the e2e testing workflow?

EDIT: I guess it's based on when we use the gorelease action, right?

[puffitos]

the template file path is wrong :)

SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl

[puffitos]

maybe leave out the , at the end? This creates a weird looking table:

❯ SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl
 ✔ Parsed image                                                                                                    sha256:930220dd636d6eb9c4fb64fb6a3da870d47fda214c2421e5480b25b79ad87659
 ✔ Cataloged contents                                                                                                     a3c35079ee159927516b3059d49f1b0e6c34fc1c62a545d6da1985490e971f42
   ├── ✔ Packages                        [53 packages]
   ├── ✔ File digests                    [1 files]
   ├── ✔ File metadata                   [1 locations]
   └── ✔ Executables                     [1 executables]
| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
| github.com/beorn7/perks | go-module | v1.0.1 | MIT,  |
| github.com/caas-team/sparrow | go-module | v0.5.0 |  |
| github.com/cenkalti/backoff/v4 | go-module | v4.3.0 | MIT,  |
| github.com/cespare/xxhash/v2 | go-module | v2.3.0 | MIT,  |
| github.com/fsnotify/fsnotify | go-module | v1.7.0 | BSD-3-Clause,  |
...

EDIT: I'll take a look on how to make this look proper, this can be done with go templating, if that's what they're using in syft.

[puffitos]

OK, how about this:

| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
{{- range .artifacts}}
| {{.name}} | {{.type}} | {{.version}} | {{range $index, $licence := .licenses}}{{- if $index}}, {{end}}{{$licence.value}}{{end}} |
{{- end}}

This produces the following output:

❯ SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true syft ghcr.io/caas-team/sparrow:v0.5.0 -o template -t scripts/sbom/example.sbom.tmpl
 ✔ Parsed image                                                                                                    sha256:930220dd636d6eb9c4fb64fb6a3da870d47fda214c2421e5480b25b79ad87659
 ✔ Cataloged contents                                                                                                     a3c35079ee159927516b3059d49f1b0e6c34fc1c62a545d6da1985490e971f42
   ├── ✔ Packages                        [53 packages]
   ├── ✔ File digests                    [1 files]
   ├── ✔ File metadata                   [1 locations]
   └── ✔ Executables                     [1 executables]
| Package | Type | Version | Licenses |
| ------- | ---- | ------- | -------- |
| github.com/beorn7/perks | go-module | v1.0.1 | MIT |
| github.com/caas-team/sparrow | go-module | v0.5.0 |  |
| github.com/cenkalti/backoff/v4 | go-module | v4.3.0 | MIT |
| github.com/cespare/xxhash/v2 | go-module | v2.3.0 | MIT |
| github.com/fsnotify/fsnotify | go-module | v1.7.0 | BSD-3-Clause |
| github.com/getkin/kin-openapi | go-module | v0.128.0 | MIT |
| github.com/go-chi/chi/v5 | go-module | v5.1.0 | MIT |
| github.com/go-logr/logr | go-module | v1.4.2 | Apache-2.0 |
| github.com/go-logr/stdr | go-module | v1.2.2 | Apache-2.0 |
| github.com/go-openapi/jsonpointer | go-module | v0.21.0 | Apache-2.0 |
| github.com/go-openapi/swag | go-module | v0.23.0 | Apache-2.0 |
| github.com/go-viper/mapstructure/v2 | go-module | v2.1.0 | MIT |
| github.com/google/uuid | go-module | v1.6.0 | BSD-3-Clause |
| github.com/grpc-ecosystem/grpc-gateway/v2 | go-module | v2.24.0 | BSD-3-Clause |
| github.com/invopop/yaml | go-module | v0.3.1 | BSD-3-Clause, MIT |
| github.com/josharian/intern | go-module | v1.0.0 | MIT |
| github.com/klauspost/compress | go-module | v1.17.9 | Apache-2.0, BSD-3-Clause, MIT |
...

[puffitos]

I don't think that SH is a supported github markdown info string. Just use shell or bash or just sh?