feat(ci): generate and validate SBOM (#299) #11

	# SPDX-License-Identifier: Apache-2.0

	name: Merge to Main

	on:
	# https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
	push:
	branches:
	- main

	jobs:
	build:
	name: Build
	runs-on: ubuntu-latest
	strategy:
	matrix:
	go: [ "^1.17", "^1.18" ]
	steps:
	- name: Checkout Repository
	uses: actions/checkout@v3
	- name: Setup Go
	uses: actions/setup-go@v3
	with:
	go-version: ${{ matrix.go }}
	- name: Setup
	run: make setup
	#- name: Lint
	# run: make lint
	- name: Lint
	run: make check-headers
	- name: Build
	run: make build
	generate-and-validate:
	name: Generate and validate SBOM file
	runs-on: ubuntu-latest
	strategy:
	matrix:
	go: [ "^1.20" ]
	steps:
	- name: Checkout the repository
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Setup Go
	uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
	with:
	go-version: ${{ matrix.go }}
	- name: Generate SBOM
	run: make generate
	- name: Validate SBOM
	uses: chainguard-dev/actions/setup-spdx@main
	with:
	sbom-path: examples/sbom.spdx

Provide feedback