Playing around with SBOM generation

.github/workflows/createSBOM.yml

@@ -1,4 +1,19 @@
 name: createSBOM.yml
+
 on:
+  release:
+    types: [created]
 
 jobs:
+  create-sbom:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Generate SBOM with Syft
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          config: ".syft/config.yml"

.syft/config.yaml

@@ -0,0 +1,12 @@
+# a list of globs to exclude from scanning, for example:
+# exclude:
+#   - "/etc/**"
+#   - "./out/**/*.json"
+# SYFT_EXCLUDE env var / --exclude flag
+#
+# For studio-client plugins you can skip the scanning process
+# because they are not supposed to introduce new dependencies.
+# The dependencies in the lockfile are considered runtime dependencies.
+# The actual version is determined by the studio-client application.
+exclude:
+  - "/studio-client/**"