From c444227d78c6631162eaf159c54897d039e5976f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?=
 <puerco@carabiner.dev>
Date: Mon, 14 Sep 2026 19:52:13 -0600
Subject: [PATCH] Generate the release SBOM with the carabiner sbom action
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The release job pinned Go 1.25 for bom, which broke once go.mod
required 1.26. Replace bom with the carabiner-dev/actions/sbom/source
action, which discovers the Go codebase with unpack, needs no Go
toolchain and writes an SPDX 3 SBOM, and publish the files it reports
as the release assets. The Go setup and tag steps go away with it.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>
---
 .github/workflows/release.yaml | 27 ++++++++-------------------
 1 file changed, 8 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8457e88..bc9b178 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -17,35 +17,24 @@ jobs:
       contents: write # needed to write releases
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set tag output
-        id: tag
-        run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v3
-        with:
-          go-version: '1.25'
-          cache: false
-          check-latest: true
-
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 1
 
-      - name: Install bom
-        uses: kubernetes-sigs/release-actions/setup-bom@b5b8280a60e6e20607f77068011269b982c60971 # v0.4.5
-
       - name: Generate SBOM
-        shell: bash
-        run: |
-          bom generate --format=json -o /tmp/${{github.event.repository.name}}-${{ steps.tag.outputs.tag_name }}.spdx.json .
+        id: sbom
+        uses: carabiner-dev/actions/sbom/source@32587e82f960d49b36101e8c45d1956e511965d3 # v1.2.9
+        with:
+          format: spdx3
+          output-path: /tmp
+          codebases: "golang:." # Only generate the SBOM for the main go codebase
 
       - name: Publish Release
         uses: kubernetes-sigs/release-actions/publish-release@b5b8280a60e6e20607f77068011269b982c60971 # v0.4.5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          assets: "/tmp/${{github.event.repository.name}}-${{ steps.tag.outputs.tag_name }}.spdx.json"
+          assets: ${{ steps.sbom.outputs.files }}
           sbom: false