From 8fe53ed42c522717c8c69612cc700e195b8ab2ea Mon Sep 17 00:00:00 2001
From: Elias Schneider <login@eliasschneider.com>
Date: Sun, 20 Sep 2026 15:13:11 +0200
Subject: [PATCH] ci/cd: include SBOMs for binaries

---
 .github/workflows/release.yml               |  5 +++++
 .goreleaser.yaml                            | 17 ++++++++++++++++
 scripts/development/generate-binary-sbom.sh | 22 +++++++++++++++++++++
 3 files changed, 44 insertions(+)
 create mode 100755 scripts/development/generate-binary-sbom.sh

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 362c2fa3..1aa42211 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,6 +39,11 @@ jobs:
           go-version-file: backend/go.mod
           cache-dependency-path: backend/go.sum
 
+      - name: Setup Syft
+        uses: anchore/sbom-action/download-syft@v0.24.2
+        with:
+          syft-version: v1.52.0
+
       - name: Set up Depot CLI
         uses: depot/setup-action@v1
 
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a96c6106..9bf3c7e4 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -94,6 +94,23 @@ archives:
 checksum:
   name_template: checksums.txt
 
+sboms:
+  - id: binaries
+    artifacts: binary
+    disable: '{{ if index .Env "BUILD_NEXT" }}true{{ end }}'
+    documents:
+      - "pocket-id_{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ targetVariant . }}.sbom.spdx.json"
+    cmd: sh
+    args:
+      - ../scripts/development/generate-binary-sbom.sh
+      - $artifact
+      - $document
+      - "pocket-id_{{ .Os }}_{{ .Arch }}{{ targetVariant . }}"
+      - "{{ .Version }}"
+    env:
+      - SYFT_CHECK_FOR_APP_UPDATE=false
+      - SYFT_CACHE_DIR=
+
 docker_digest:
   name_template: digests.txt
 
diff --git a/scripts/development/generate-binary-sbom.sh b/scripts/development/generate-binary-sbom.sh
new file mode 100755
index 00000000..71fd5ce3
--- /dev/null
+++ b/scripts/development/generate-binary-sbom.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+set -eu
+
+artifact_path=$1
+document_path=$2
+source_name=$3
+source_version=$4
+frontend_sbom_path="../.tmp/frontend.cdx.json"
+
+work_dir=$(mktemp -d "${TMPDIR:-/tmp}/pocket-id-binary-sbom.XXXXXX")
+trap 'rm -rf "$work_dir"' EXIT
+
+cp "$artifact_path" "$work_dir/$(basename "$artifact_path")"
+cp "$frontend_sbom_path" "$work_dir/frontend.cdx.json"
+
+syft "dir:$work_dir" \
+    --select-catalogers "+sbom-cataloger" \
+    --source-name "$source_name" \
+    --source-version "$source_version" \
+    --output "spdx-json=$document_path" \
+    --enrich all