[CRA][WS3] SBOM per release - generate-sbom.sh integration (M-009)

[ajlennon]

Workstream

WS3 — Supply chain and vulnerability

Programme: https://github.com/DynamicDevices/mender-rt1180-zephyr/blob/main/mender-mcu-integration/PROJECT-NOTES.md#ws3--supply-chain-and-vulnerability · Parent: #1

Milestone

ID	Milestone	Target	Status
M-009	generate-sbom.sh + west spdx per board	2026 Q2	Open

Definition of done

• ./scripts/generate-sbom.sh runs west spdx for EVK + FRDM build dirs (requires prior sysbuild)
• SPDX archived under sbom/ per release, tagged with CONFIG_MENDER_ARTIFACT_NAME / git SHA
• Inventory attributes include sbom_id when M-009 exists (pre-production checklist)

Dependencies

• Successful Phase 0 host builds for target boards
• Script reference in PROJECT-NOTES tooling table