Merge pull request #140 from smlx/explicit-gitignore

fix: explicitly gitignore the temporary sbom file

Author: smlx

.github/workflows/release.yaml

@@ -69,9 +69,7 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Move sbom to avoid dirty git
-      run: |
-        mkdir -p ./dist
-        mv "$GITHUB_SBOM_PATH" ./dist/sbom.spdx.json
+      run: mv "$GITHUB_SBOM_PATH" ./sbom.spdx.json
       env:
         GITHUB_SBOM_PATH: ${{ steps.sbom.outputs.fileName }}
     - uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
@@ -80,4 +78,4 @@ jobs:
         args: release --clean
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITHUB_SBOM_PATH: ./dist/sbom.spdx.json
+        GITHUB_SBOM_PATH: ./sbom.spdx.json

.gitignore

@@ -1,2 +1,3 @@
 /dist
 /cover.out
+/sbom.spdx.json

.goreleaser.yaml

@@ -74,4 +74,4 @@ docker_signs:
 release:
   extra_files:
   - glob: "{{ .Env.GITHUB_SBOM_PATH }}"
-    name_template: "go-cli-github.v{{ .Version }}.sbom.spdx.json"
+    name_template: "{{ .ProjectName }}.v{{ .Version }}.sbom.spdx.json"