add the sbom auto install for a given tool

Author: ChronosMasterOfAllTime

cmd/compliance/sbom.go

@@ -322,6 +322,11 @@ func enhanceSBOM(cfg *config.Config, mgr *manager.Manager, cmd *cobra.Command) e
 
 // resolveSBOMTool finds the tool binary in goenv-managed paths
 func resolveSBOMTool(cfg *config.Config, tool string) (string, error) {
+	sbomTools := map[string]string{
+		"cyclonedx-gomod": "github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod",
+		"syft":            "github.com/anchore/syft/cmd/syft",
+	}
+
 	// Check host-specific bin directory first using consolidated utility
 	hostBin := cfg.HostBinDir()
 	if toolPath, err := utils.FindExecutable(hostBin, tool); err == nil {
@@ -333,14 +338,37 @@ func resolveSBOMTool(cfg *config.Config, tool string) (string, error) {
 		return path, nil
 	}
 
+	goTool, ok := sbomTools[tool]
+	if !ok {
+		return "", fmt.Errorf("unsupported SBOM tool: %s", tool)
+	}
+
+	goTool = fmt.Sprintf("%s@latest", goTool)
+
+	fmt.Printf("goenv: %s not found in goenv-managed paths or system PATH. Attempting to install...\n", tool)
+
+	cmd := exec.Command("goenv", "tools", "install", goTool)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	err := cmd.Run()
+	if err == nil {
+		// Retry finding the tool after installation; it will be rehashed into the shims automatically
+		if toolPath, err := utils.FindExecutable(hostBin, tool); err == nil {
+			return toolPath, nil
+		}
+	} else {
+		return "", fmt.Errorf("goenv: Failed to install %s: %w", tool, err)
+	}
+
 	// Tool not found - provide actionable error
 	return "", fmt.Errorf(`%s not found
 
 To install:
-  goenv tools install %s@latest
+  goenv tools install %s
 
 Or install system-wide with:
-  go install <package-path>`, tool, tool)
+  go install %s`, tool, goTool, goTool)
 }
 
 // buildCycloneDXCommand builds the cyclonedx-gomod command

cmd/compliance/sbom_test.go

@@ -128,9 +128,7 @@ func TestResolveSBOMTool_NotFound(t *testing.T) {
 	_, err := resolveSBOMTool(cfg, "nonexistent-tool")
 	assert.Error(t, err, "Expected error for non-existent tool")
 
-	assert.Contains(t, err.Error(), "not found", "Expected 'not found' error %v", err)
-
-	assert.Contains(t, err.Error(), "goenv tools install", "Expected installation instructions in error %v", err)
+	assert.Contains(t, err.Error(), "unsupported SBOM tool", "Expected 'unsupported SBOM tool' error %v", err)
 }
 
 func TestBuildCycloneDXCommand(t *testing.T) {