Adds SBOM generation

.github/workflows/sbom.yml

@@ -0,0 +1,45 @@
+---
+name: Generate SBOMs
+
+on:
+  release:
+    types:
+      - published
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build Golang SBOM
+        uses: sbomify/github-action@master
+        env:
+          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
+          COMPONENT_ID: 'LCJffn8vKX'
+          LOCK_FILE: 'go.mod'
+          OVERRIDE_NAME: true
+          SBOM_VERSION: ${{ github.ref_name }}
+          AUGMENT: true
+          ENRICH: true
+          OUTPUT_FILE: 'helix-golang.cdx.json'
+
+      - name: Build JavaScript SBOM
+        uses: sbomify/github-action@master
+        env:
+          TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
+          COMPONENT_ID: 'Z_wMfn8vWv'
+          LOCK_FILE: 'frontend/yarn.lock'
+          OVERRIDE_NAME: true
+          SBOM_VERSION: ${{ github.ref_name }}
+          AUGMENT: true
+          ENRICH: true
+          OUTPUT_FILE: 'helix-js.cdx.json'
+
+      - name: Attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: '${{ github.workspace }}/*.cdx.json'

README.md

@@ -16,6 +16,8 @@
 
 # HelixML
 
+[![sbomified](https://sbomify.com/assets/images/logo/badge.svg)](https://app.sbomify.com/project/YKA8fn8v2Q)
+
 [👥 Discord](https://discord.gg/VJftd844GE)
 
 Private GenAI stack. Deploy the best of open AI in your own data center or VPC and retain complete data security & control.