Add release SBOM artifact

Author: RamazanKara

CHANGELOG.md

@@ -42,6 +42,7 @@
 - Added a release installer script that detects the local platform, verifies the selected artifact against `SHA256SUMS` and `RELEASE_MANIFEST.json`, and is smoke-tested by the release gate.
 - Added `openexit completion` plus release completion assets for Bash, Zsh, Fish, and PowerShell.
 - Extended release manifests and `SHA256SUMS` to cover installer and shell-completion assets as well as platform binaries.
+- Added `openexit sbom` and a verified release `SBOM.cdx.json` asset with CycloneDX JSON dependency metadata.
 - Added `make release-check` and wired the draft-release workflow to run the full release gate before packaging artifacts.
 - Updated push CI to run the same release readiness gate, including smoke pipelines and bundle verification.
 - Updated CI and release workflows to Node.js 24-native GitHub Actions.

Makefile

@@ -7,7 +7,8 @@ LDFLAGS := -s -w -X github.com/RamazanKara/openexit/internal/version.Version=$(V
 GOFILES := $(shell find . -name '*.go' -not -path './bin/*' -not -path './dist/*')
 PLATFORMS ?= linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64
 RELEASE_MANIFEST ?= RELEASE_MANIFEST.json
-RELEASE_ASSETS ?= install.sh openexit.bash _openexit openexit.fish openexit.ps1
+RELEASE_SBOM ?= SBOM.cdx.json
+RELEASE_ASSETS ?= install.sh openexit.bash _openexit openexit.fish openexit.ps1 $(RELEASE_SBOM)
 GOLANGCI_LINT_VERSION ?= v2.12.2
 GOLANGCI_LINT ?= bin/golangci-lint
 EXAMPLE_INPUT ?= examples/datadog-to-grafana/input/datadog-fixture.json
@@ -135,6 +136,7 @@ release-dist:
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion zsh > dist/_openexit
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion fish > dist/openexit.fish
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit completion powershell > dist/openexit.ps1
+	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit sbom --out dist/$(RELEASE_SBOM)
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit release-manifest --dist dist --out dist/$(RELEASE_MANIFEST) $(foreach target,$(PLATFORMS),--platform $(target)) $(foreach asset,$(RELEASE_ASSETS),--asset $(asset))
 	cd dist && sha256sum openexit_* $(RELEASE_ASSETS) > SHA256SUMS
 
@@ -152,6 +154,7 @@ release-check: verify release-dist install-smoke
 	@test -s dist/_openexit
 	@test -s dist/openexit.fish
 	@test -s dist/openexit.ps1
+	@test -s dist/$(RELEASE_SBOM)
 	@expected=$$(printf '%s\n' $(PLATFORMS) $(RELEASE_ASSETS) | wc -w | tr -d ' '); \
 	actual=$$(wc -l < dist/SHA256SUMS | tr -d ' '); \
 	if [ "$$actual" != "$$expected" ]; then \

README.md

@@ -51,7 +51,7 @@ Release candidates can be built locally with:
 make release-check VERSION=0.1.0
 ```
 
-This runs the release gate, writes OS/architecture binaries, writes `dist/SHA256SUMS`, writes `dist/RELEASE_MANIFEST.json`, and verifies the release artifacts.
+This runs the release gate, writes OS/architecture binaries, writes `dist/SHA256SUMS`, writes `dist/RELEASE_MANIFEST.json`, writes `dist/SBOM.cdx.json`, and verifies the release artifacts.
 
 Refresh the checked-in Datadog example project with:
 
@@ -89,6 +89,7 @@ make example VERSION=0.1.0-dev
 - `openexit release-manifest [--dist dist --out dist/RELEASE_MANIFEST.json]`
 - `openexit verify-release <manifest.json> [--dist dist] [--artifact <name>] [--require-checksums] [--json]`
 - `openexit completion [bash|zsh|fish|powershell]`
+- `openexit sbom [--out SBOM.cdx.json]`
 - `openexit assist summarize --project <project-dir> --provider noop`
 
 The Datadog, GitHub, Okta, Auth0, Cloudflare, Akamai, OpenAI, and Anthropic collectors are read-only. API tokens are read from environment variables or local credential files, are not printed, and are not stored.
@@ -140,6 +141,7 @@ Included in the current implementation:
 - Offline release artifact verification for binaries and auxiliary assets against `RELEASE_MANIFEST.json` and optional `SHA256SUMS`.
 - Release installer script that selects the current platform binary and verifies it before installation.
 - Shell completion generation for Bash, Zsh, Fish, and PowerShell, including release-provided completion assets.
+- CycloneDX JSON SBOM generation for the OpenExit binary and Go module dependencies.
 - Evidence bundle path-safety checks that reject symlinks in exported project sections.
 - No-op assist provider and explicit opt-in LiteLLM assist.
 - GitHub Enterprise to Forgejo assessment path with fixture import and live repository inventory collection.

docs/cli.md

@@ -41,6 +41,8 @@ The checked-in Datadog example can be refreshed with `make example VERSION=0.1.0
 
 `openexit completion bash|zsh|fish|powershell` prints shell completion scripts. Release artifacts also include `openexit.bash`, `_openexit`, `openexit.fish`, and `openexit.ps1` so package managers and manual installs can wire completion without rebuilding from source.
 
+`openexit sbom --out SBOM.cdx.json` writes a CycloneDX JSON SBOM for the current OpenExit binary. It records the stamped OpenExit version, commit, build date, Go toolchain version, and Go module dependencies reported by the binary build info. Release builds include `SBOM.cdx.json` and cover it with both `RELEASE_MANIFEST.json` and `SHA256SUMS`.
+
 Generate individual artifacts with `openexit generate --artifact <name>`. The primary Datadog path supports `mapping`, `assessment`, `risk-register`, `manual-review`, `cost-drivers`, `target-architecture`, `acceptance-criteria`, `rollback-plan`, `runbook`, `restore-drill-checklist`, `alert-shadowing-plan`, `migration-plan`, `grafana-dashboards`, `prometheus-rules`, `opentelemetry`, and `argocd`. The GitHub Enterprise path also supports `forgejo-migration-candidate`; the identity path also supports `realm-client-candidate`; the edge path also supports `vcl-candidates`, `haproxy-candidates`, and `coraza-rule-candidates`; the AI provider path also supports `litellm-config-candidate`.
 
 The GitHub Enterprise to Forgejo fixture path uses local JSON metadata:

docs/release.md

@@ -23,6 +23,7 @@ Release-blocking v0.1 requirements:
 - Machine-readable release manifest generation and offline release artifact verification for OS/architecture binaries, auxiliary release assets, and `SHA256SUMS`.
 - Verified release installer for Linux/macOS `amd64` and `arm64` downloads.
 - Shell completion generation and release completion assets for Bash, Zsh, Fish, and PowerShell.
+- CycloneDX JSON SBOM generation for release binaries and Go module dependencies.
 - No-op AI assist and optional external assist behind explicit opt-in.
 - Documentation, examples, CI, release draft workflow, and reproducible release artifacts.
 
@@ -42,7 +43,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
 - [ ] `make release-check VERSION=0.1.0` passes locally, including verification, CLI smoke pipelines, bundle verification, release artifact builds, installer smoke, and checksum count checks.
 - [ ] `make verify VERSION=0.1.0` passes, including CLI smoke pipelines.
 - [ ] `make lint` runs `gofmt`, `golangci-lint`, and `go vet`.
-- [ ] `make release-dist VERSION=0.1.0` produces binaries, `dist/SHA256SUMS`, `dist/RELEASE_MANIFEST.json`, `dist/install.sh`, and completion assets `openexit.bash`, `_openexit`, `openexit.fish`, and `openexit.ps1`.
+- [ ] `make release-dist VERSION=0.1.0` produces binaries, `dist/SHA256SUMS`, `dist/RELEASE_MANIFEST.json`, `dist/SBOM.cdx.json`, `dist/install.sh`, and completion assets `openexit.bash`, `_openexit`, `openexit.fish`, and `openexit.ps1`.
 - [ ] `openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` passes and covers binaries, `install.sh`, and completion assets; it fails when a release artifact is tampered with.
 - [ ] `OPENEXIT_VERSION=0.1.0 OPENEXIT_BASE_URL=$PWD/dist BIN_DIR=$(mktemp -d)/bin sh scripts/install.sh` installs a verified local release binary and `openexit version` reports `0.1.0`.
 - [ ] `make example VERSION=0.1.0-dev` refreshes `examples/datadog-to-grafana/output/` and exports `examples/datadog-to-grafana/openexit-example.zip`.
@@ -55,6 +56,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
 - [ ] `openexit run --project <demo> --export --out <zip>` completes a collected project through assessment, mapping, generation, validation, status reporting, and bundle export.
 - [ ] `openexit status --project <demo>` reports inventory, assessment, mapping, generated artifacts, validation status, export readiness, and matching `--json` output.
 - [ ] `openexit completion bash`, `zsh`, `fish`, and `powershell` each generate non-empty shell completion scripts.
+- [ ] `openexit sbom --out SBOM.cdx.json` generates valid CycloneDX JSON with OpenExit build metadata and Go module dependencies.
 - [ ] `README.md`, `docs/cli.md`, `docs/security.md`, and this checklist reflect current behavior.
 - [ ] `examples/datadog-to-grafana/README.md` reproduces the primary local demo.
 - [ ] `assessment/openexit.migration-plan.yaml`, `.json`, and `migration-plan.md` are generated by the demo pipeline and included in exported bundles.
@@ -73,7 +75,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
 - [ ] Exported bundle README includes version, commit, build date, bundle timestamp, and candidate warning.
 - [ ] Exported bundle `manifest.json` includes build metadata, project source/target, validation totals, and per-file SHA-256 digests, and validates against `schemas/openexit.evidence-bundle.schema.json`.
 - [ ] `openexit verify-bundle <zip>` passes for exported bundles and fails when an archived file is tampered with.
-- [ ] Release manifest validates against `schemas/openexit.release-manifest.schema.json` and includes version, commit, build date, generation time, artifact type, binary OS/architecture metadata, sizes, and SHA-256 digests.
+- [ ] Release manifest validates against `schemas/openexit.release-manifest.schema.json` and includes version, commit, build date, generation time, artifact type, binary OS/architecture metadata, sizes, and SHA-256 digests, including `SBOM.cdx.json`.
 - [ ] Export refuses symlinks in exported project sections, including when `--force` is used.
 - [ ] No credentials, tokens, passwords, or private keys are present in fixtures, generated files, docs, or bundles.
 - [ ] Draft release notes have been reviewed.

docs/schemas.md

@@ -4,7 +4,7 @@ OpenExit schemas live under `schemas/` and mirror the typed Go manifests. Releas
 
 Evidence bundle exports include `openexit-evidence/manifest.json`, which follows `schemas/openexit.evidence-bundle.schema.json`. The manifest records OpenExit build metadata, project source/target metadata, validation totals, and SHA-256 digests for exported project files so downstream review tooling can verify a bundle without parsing every human-readable report first.
 
-Release builds include `RELEASE_MANIFEST.json`, which follows `schemas/openexit.release-manifest.schema.json`. The manifest records OpenExit build metadata and every release artifact that should be covered by `SHA256SUMS`: platform binaries use `type: binary` with `os` and `arch`, while installer and shell-completion files use `type: asset`.
+Release builds include `RELEASE_MANIFEST.json`, which follows `schemas/openexit.release-manifest.schema.json`. The manifest records OpenExit build metadata and every release artifact that should be covered by `SHA256SUMS`: platform binaries use `type: binary` with `os` and `arch`, while installer, shell-completion, and SBOM files use `type: asset`.
 
 Project manifests must use one of the supported source/target pairs: Datadog to Grafana LGTM, GitHub Enterprise to Forgejo, Okta/Auth0 to Keycloak/Zitadel, Cloudflare/Akamai to Varnish/HAProxy/Coraza, or OpenAI/Anthropic to vLLM/LiteLLM.
 

internal/app/command.go

@@ -25,6 +25,7 @@ import (
 	"github.com/RamazanKara/openexit/internal/inventory"
 	"github.com/RamazanKara/openexit/internal/mapping"
 	openrelease "github.com/RamazanKara/openexit/internal/release"
+	opensbom "github.com/RamazanKara/openexit/internal/sbom"
 	"github.com/RamazanKara/openexit/internal/validate"
 	"github.com/RamazanKara/openexit/internal/version"
 	"github.com/spf13/cobra"
@@ -54,6 +55,7 @@ func NewRootCommand() *cobra.Command {
 	root.AddCommand(newReleaseManifestCommand())
 	root.AddCommand(newVerifyReleaseCommand())
 	root.AddCommand(newCompletionCommand(root))
+	root.AddCommand(newSBOMCommand())
 	root.AddCommand(newAssistCommand())
 	return root
 }
@@ -1059,6 +1061,38 @@ func newCompletionCommand(root *cobra.Command) *cobra.Command {
 	return cmd
 }
 
+func newSBOMCommand() *cobra.Command {
+	var out string
+	cmd := &cobra.Command{
+		Use:   "sbom",
+		Short: "Generate a CycloneDX JSON SBOM for this OpenExit binary",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			bom, err := opensbom.Generate(opensbom.Options{
+				Name:    version.Name,
+				Version: version.Version,
+				Commit:  version.Commit,
+				Date:    version.Date,
+			})
+			if err != nil {
+				return err
+			}
+			if out == "" {
+				enc := json.NewEncoder(cmd.OutOrStdout())
+				enc.SetIndent("", "  ")
+				return enc.Encode(bom)
+			}
+			if err := opensbom.Write(out, bom); err != nil {
+				return err
+			}
+			_, _ = fmt.Fprintf(cmd.OutOrStdout(), "sbom: %s\n", out)
+			_, _ = fmt.Fprintf(cmd.OutOrStdout(), "components: %d\n", len(bom.Components))
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&out, "out", "", "Write SBOM to file instead of stdout")
+	return cmd
+}
+
 func newAssistCommand() *cobra.Command {
 	root := &cobra.Command{
 		Use:   "assist",

internal/app/e2e_test.go

@@ -13,6 +13,7 @@ import (
 	"testing"
 
 	openrelease "github.com/RamazanKara/openexit/internal/release"
+	opensbom "github.com/RamazanKara/openexit/internal/sbom"
 	publicschemas "github.com/RamazanKara/openexit/schemas"
 	"github.com/santhosh-tekuri/jsonschema/v6"
 )
@@ -271,6 +272,36 @@ func TestCompletionCommandGeneratesShellScripts(t *testing.T) {
 	}
 }
 
+func TestSBOMCommandGeneratesCycloneDXJSON(t *testing.T) {
+	out, err := executeForTestWithOutput("sbom")
+	if err != nil {
+		t.Fatalf("openexit sbom failed: %v\n%s", err, out)
+	}
+	var bom opensbom.BOM
+	if err := json.Unmarshal([]byte(out), &bom); err != nil {
+		t.Fatalf("decode SBOM JSON: %v\n%s", err, out)
+	}
+	if bom.BOMFormat != opensbom.BOMFormat || bom.SpecVersion != opensbom.SpecVersion || bom.Metadata.Component.Name != "openexit" {
+		t.Fatalf("unexpected SBOM: %+v", bom)
+	}
+
+	path := filepath.Join(t.TempDir(), "SBOM.cdx.json")
+	out, err = executeForTestWithOutput("sbom", "--out", path)
+	if err != nil {
+		t.Fatalf("openexit sbom --out failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "components:") {
+		t.Fatalf("expected SBOM summary, got:\n%s", out)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(data, &bom); err != nil {
+		t.Fatalf("decode written SBOM JSON: %v\n%s", err, string(data))
+	}
+}
+
 func TestStatusReportsPipelineReadiness(t *testing.T) {
 	projectDir := filepath.Join(t.TempDir(), "demo")
 	fixturePath := filepath.Join("..", "..", "testdata", "datadog", "small.json")