add syft to github workflow

Author: mxmehl

.github/workflows/selftest.yaml

@@ -11,8 +11,21 @@ on:
   pull_request:
 
 jobs:
-  # Generate SBOM using cdxgen, but with NPMJS package, not Docker container
-  sbom-gen:
+  # Generate SBOM using syft
+  sbom-gen-syft:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - run: mkdir -p ~/.local/bin
+      - name: Install syft
+        run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b ~/.local/bin
+      - name: Install compliance-assistant
+        uses: ./.github/actions/poetrybuild
+      - name: Generate SBOM with syft
+        run: poetry run compliance-assistant sbom generate -v -g syft -d . -o ${{ runner.temp }}/sbom-raw.json
+
+  # Generate SBOM using cdxgen (npm package)
+  sbom-gen-cdxgen:
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -29,7 +42,7 @@ jobs:
   # Enrich the generated SBOM
   sbom-enrich:
     runs-on: ubuntu-22.04
-    needs: sbom-gen
+    needs: sbom-gen-cdxgen
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/poetrybuild