refactor: rewrite attach SBOM in just (#2961)

For consistency and debugability.

.github/workflows/reusable-build.yml

@@ -404,25 +404,25 @@ jobs:
         run: |
           just login-registry oras ghcr.io
 
-      - name: Upload SBOM
+      - name: Attach SBOM
         if: inputs.publish
-        id: upload-sbom
+        id: attach-sbom
         env:
-          IMAGE: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          MATRIX_BASE_NAME: "${{ matrix.base_name }}"
+          MATRIX_STREAM_NAME: "${{ matrix.stream_name }}"
+          MATRIX_IMAGE_FLAVOR: "${{ matrix.image_flavor }}"
           DIGEST: ${{ steps.pre-push.outputs.digest }}
-          IMAGE_NAME: ${{ env.IMAGE_NAME }}
         run: |
-          SBOM="sbom_out/${IMAGE_NAME}/sbom.json"
+          set -euox pipefail
 
-          cd "$(dirname "${SBOM}")"
-          oras attach \
-          --artifact-type application/vnd.spdx+json \
-          --annotation filename=$(basename "$SBOM") \
-          "${IMAGE}@${DIGEST}" \
-          "$(basename ${SBOM})"
-
-          sbom_digest=$(oras discover --format json "${IMAGE}@${DIGEST}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')
+          $(command -v just) attach-sbom \
+            --image "${MATRIX_BASE_NAME}" \
+            --tag "${MATRIX_STREAM_NAME}" \
+            --flavor "${MATRIX_IMAGE_FLAVOR}" \
+            --registry "${IMAGE_REGISTRY}" \
+            --digest "${DIGEST}"
 
+          sbom_digest=$(< /tmp/sbom-digestfile)
           echo "sbom_digest=${sbom_digest}" >> $GITHUB_OUTPUT
 
       - name: Sign SBOM OCI Artifact
@@ -431,7 +431,7 @@ jobs:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
-          SBOM_DIGEST: ${{ steps.upload-sbom.outputs.sbom_digest }}
+          SBOM_DIGEST: ${{ steps.attach-sbom.outputs.sbom_digest }}
         run: |
           cosign sign -y --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${SBOM_DIGEST}
 

Justfile

@@ -739,6 +739,43 @@ gen-sbom $image=default_image $tag=default_tag $flavor=default_flavor $syft_cmd=
 
     rm -rf "${ROOTFS}"
 
+# Attach sbom to exisitng image
+[arg("digest", long="digest")]
+[arg("flavor", long="flavor", short="f")]
+[arg("image", long="image", short="i")]
+[arg("registry", long="registry")]
+[arg("tag", long="tag", short="t")]
+[group('Utility')]
+attach-sbom $image=default_image $tag=default_tag $flavor=default_flavor $registry="" $digest="":
+    #!/usr/bin/env bash
+    set -eoux pipefail
+
+    {{ just }} validate --image "${image}" --tag "${tag}" --flavor "${flavor}"
+    image_name=$({{ just }} image_name --image "${image}" --tag "${tag}" --flavor "${flavor}")
+
+    OUT_DIR="sbom_out/${image_name}"
+    SBOM="sbom.json"
+    FULL_SBOM_PATH="${OUT_DIR}/${SBOM}"
+    IMAGE="${registry}/${image_name}:${tag}@${digest}"
+
+    # we need to be in the directory of the sbom json file or else we end up having the directories in the oci artifact
+    pushd "${OUT_DIR}"
+
+    oras attach \
+      --artifact-type application/vnd.spdx+json \
+      --annotation filename="${SBOM}" \
+      "${IMAGE}" \
+      "${SBOM}"
+
+    popd
+
+    SBOM_DIGEST="$(oras discover --format json "${IMAGE}" | jq -r '.referrers[] | select(.artifactType == "application/vnd.spdx+json") | .digest')"
+
+    echo "${SBOM_DIGEST}" > /tmp/sbom-digestfile
+
+    # debugging
+    echo "oras pull ${registry}/${image_name}:${tag}@${SBOM_DIGEST}"
+
 # We are not using https://github.com/actions/cache because of:
 # https://github.com/ublue-os/aurora/issues/2351
 # https://github.com/actions/cache/issues/1537