From e828c21545a176e9eb79df4966cf47b7bf37cfa3 Mon Sep 17 00:00:00 2001
From: Dmitriy Ivolgin <dmitriy@replicated.com>
Date: Mon, 17 Aug 2026 11:26:40 -0700
Subject: [PATCH] Generate and sign SBOM (#2108)

---
 .github/workflows/release.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b3eaa78e..fddd567d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -27,6 +27,15 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.2
+
+      - name: Generate and sign SBOM
+        run: make sbom
+        env:
+          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v7
         with: