chore: add root syft config for the source SBOM

Merged
JI
1d ago
+22-0

Add a root .syft.yaml so that the source SBOM of the managed sbom-generation workflow lists only what this repository ships, with a license for each package.

The source SBOM failed sbom-with-licenses (592 violations) and sbom-banned-licenses (1 violation):

  • Syft found no license for the Go modules, because the scan has no module cache.
  • The SBOM listed GitHub Actions, manifest files, CI tooling (extras), the policy SDKs in labs and test data. These are not shipped.
  • The banned license is a misspelled license name (BSD-Clause-3) in a dependency of labs/wasm-policy-sdk/js.

The config turns on remote license lookup for Go modules, excludes .github, extras, labs and testdata, and does not list manifest files as components. The SBOM keeps the 472 Go modules of the root module, each with a license.

One violation stays: the root component of a directory scan (.) has no license. A change in the workflow contract or in the platform must fix it.

Refs PFM-8051.

AI disclosure: Claude Code helped to triage the findings and to write this change.