feat(build): attested sbom

Author: asher

.github/workflows/nightly.yml

@@ -42,3 +42,37 @@ jobs:
         TAGS: ghcr.io/edera-dev/${{ matrix.component }}:nightly
         COSIGN_EXPERIMENTAL: "true"
       run: cosign sign --yes "${TAGS}@${DIGEST}"
+
+    - name: Build `build` stage for SBOM scan
+      uses: docker/build-push-action@15560696de535e4014efeff63c48f16952e52dd1 # v6.2.0
+      with:
+        file: ./Dockerfile.${{ matrix.component }}
+        target: build
+        platforms: linux/amd64
+        load: true
+        tags: sbom-scan-${{ matrix.component }}:latest
+    - uses: anchore/sbom-action/download-syft@36a5fde73e0fcb1d1e70be9ad66b4724e783bda7 # pinned to match Protect build-and-sign-image
+      id: syft
+    - name: Generate and attest CycloneDX SBOM
+      env:
+        DIGEST: ${{ steps.push-step.outputs.digest }}
+        TAGS: ghcr.io/edera-dev/${{ matrix.component }}:nightly
+        SYFT_CMD: ${{ steps.syft.outputs.cmd }}
+        COMPONENT: ${{ matrix.component }}
+        COSIGN_EXPERIMENTAL: "true"
+      run: |
+        set -euo pipefail
+        # scope to the alpine package db only
+        "${SYFT_CMD}" "docker:sbom-scan-${COMPONENT}:latest" \
+          --override-default-catalogers apk-db-cataloger \
+          --select-catalogers "-file" \
+          --source-name "${COMPONENT}" \
+          -o "cyclonedx-json=${COMPONENT}.cdx.json"
+        jq -e '.bomFormat == "CycloneDX" and ((.components // []) | length > 0)' \
+          "${COMPONENT}.cdx.json" >/dev/null \
+          || { echo "::error::SBOM for ${COMPONENT} is empty or invalid"; exit 1; }
+        jq '{component: env.COMPONENT, components: (.components | length)}' \
+          "${COMPONENT}.cdx.json"
+        cosign attest --yes --type cyclonedx \
+          --predicate "${COMPONENT}.cdx.json" \
+          "${TAGS}@${DIGEST}"