Generate the release SBOM with the carabiner sbom action

.github/workflows/release.yaml

@@ -17,35 +17,24 @@ jobs:
       contents: write # needed to write releases
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set tag output
-        id: tag
-        run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v3
-        with:
-          go-version: '1.25'
-          cache: false
-          check-latest: true
-
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 1
 
-      - name: Install bom
-        uses: kubernetes-sigs/release-actions/setup-bom@b5b8280a60e6e20607f77068011269b982c60971 # v0.4.5
-
       - name: Generate SBOM
-        shell: bash
-        run: |
-          bom generate --format=json -o /tmp/${{github.event.repository.name}}-${{ steps.tag.outputs.tag_name }}.spdx.json .
+        id: sbom
+        uses: carabiner-dev/actions/sbom/source@32587e82f960d49b36101e8c45d1956e511965d3 # v1.2.9
+        with:
+          format: spdx3
+          output-path: /tmp
+          codebases: "golang:." # Only generate the SBOM for the main go codebase
 
       - name: Publish Release
         uses: kubernetes-sigs/release-actions/publish-release@b5b8280a60e6e20607f77068011269b982c60971 # v0.4.5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          assets: "/tmp/${{github.event.repository.name}}-${{ steps.tag.outputs.tag_name }}.spdx.json"
+          assets: ${{ steps.sbom.outputs.files }}
           sbom: false