feat: sbom generation ubuntu and nix packages

.github/workflows/ami-release-nix.yml

@@ -184,6 +184,36 @@ jobs:
 
           echo "Catalog uploaded to ${CATALOG_S3}"
 
+      - name: Assume SBOM artifacts role
+        uses: aws-actions/configure-aws-credentials@v4.1.0
+        with:
+          aws-region: ap-southeast-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
+          role-session-name: shared-services-jump
+
+      - name: Upload comprehensive SBOM to shared artifacts
+        uses: aws-actions/configure-aws-credentials@v4.1.0
+        with:
+          aws-region: ap-southeast-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-sbom-artifacts-role
+          role-skip-session-tagging: true
+          role-session-name: upload-sbom
+          role-chaining: true
+
+      - name: Upload SBOM
+        run: |
+          VERSION="${{ steps.process_release_version.outputs.version }}"
+
+          if [ -f "nix-sbom.spdx.json" ]; then
+            aws s3 cp nix-sbom.spdx.json \
+              "s3://${{ secrets.SHARED_AWS_ARTIFACTS_BUCKET }}/sbom/${VERSION}/sbom.spdx.json" \
+              --content-type "application/json"
+            echo "::notice title=SBOM Uploaded::Comprehensive SBOM for ${VERSION} uploaded to shared artifacts"
+          else
+            echo "::error title=SBOM Missing::SBOM file not found - build cannot proceed without SBOM"
+            exit 1
+          fi
+
       - name: Create release
         uses: softprops/action-gh-release@v2
         with:

.gitignore

@@ -33,3 +33,8 @@ common-nix.vars.pkr.hcl
 nixos.qcow2
 .lsp
 .clj-kondo
+#sbom development files
+http_cache.sqlite
+nix-sbom.spdx.json
+sbom.cdx.json
+sbom.csv