Add source dependency SBOM generation

.github/workflows/sbom.yml

@@ -0,0 +1,36 @@
+name: Software bill of materials
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sbom:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+      - name: Install Syft
+        id: syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          syft-version: v1.54.1
+      - name: Generate source SBOM
+        env:
+          SYFT: ${{ steps.syft.outputs.cmd }}
+        run: make sbom
+      - name: Upload SBOM
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: fetchit-sbom
+          path: _output/sbom/fetchit.spdx.json
+          if-no-files-found: error

Makefile

@@ -4,11 +4,16 @@ export SHELL := $(shell which bash)
 PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
 
 # Include openshift build-machinery-go libraries
+# The source SBOM does not need the vendored build machinery.
+ifneq ($(MAKECMDGOALS),sbom)
 include ./vendor/github.com/openshift/build-machinery-go/make/golang.mk
+endif
 
 SRC_ROOT :=$(shell pwd)
 
 OUTPUT_DIR :=_output
+SYFT ?= syft
+SBOM_FILE ?= $(OUTPUT_DIR)/sbom/fetchit.spdx.json
 CROSS_BUILD_BINDIR :=$(OUTPUT_DIR)/bin
 CTR_CMD :=$(or $(shell which podman 2>/dev/null), $(shell which docker 2>/dev/null))
 ARCH := $(shell uname -m |sed -e "s/x86_64/amd64/" |sed -e "s/aarch64/arm64/")
@@ -165,6 +170,12 @@ build-systemd-cross-build:
 # dev targets                 #
 ###############################
 
+# Inventory source dependencies without scanning generated output or vendored manifests.
+sbom:
+	@mkdir -p "$(dir $(SBOM_FILE))"
+	$(SYFT) scan dir:. --source-name fetchit --exclude './.git/**' --exclude './vendor/**' --exclude './$(OUTPUT_DIR)/**' --output "spdx-json=$(SBOM_FILE)"
+.PHONY: sbom
+
 clean-cross-build:
 	$(RM) -r '$(CROSS_BUILD_BINDIR)'
 	$(RM) -rf $(OUTPUT_DIR)/staging

README.md

@@ -159,6 +159,20 @@ See [image compatibility and build guidance](docs/documentation.rst) and
 
 ## Develop and validate
 
+Generate a source dependency Software Bill of Materials (SBOM) with
+[Syft](https://github.com/anchore/syft) v1.54.1 installed:
+
+```sh
+make sbom
+```
+
+The SPDX JSON is written to `_output/sbom/fetchit.spdx.json`. Override `SYFT`
+to use a different executable or `SBOM_FILE` to choose another output path.
+The SBOM workflow runs on pull requests, pushes to `main`, and manual dispatch,
+and publishes the file as the `fetchit-sbom` workflow artifact. It scans the
+source tree, excluding vendored manifests and generated output; it does not
+inventory operating system packages in the built container images.
+
 On Linux, install the GPGME, device-mapper, and libseccomp development packages
 before running unit tests: