fix: upload SBOM files even when artifact already exists

When artifact and attestation already exist in cache, we were returning
early without checking for SBOM files. This caused SBOM files to be
missing when builds were re-run.

Now we call uploadSBOMFiles in all code paths to ensure SBOM files are
uploaded if they exist locally but are missing from the cache.

Co-authored-by: Ona <no-reply@ona.com>

Author: leodido

pkg/leeway/signing/upload.go

@@ -108,12 +108,15 @@ func (u *ArtifactUploader) UploadArtifactWithAttestation(ctx context.Context, ar
 		}
 
 		if attestationExists {
-			// Both artifact and attestation exist, skip both uploads
+			// Both artifact and attestation exist, but still check SBOM files
 			log.WithFields(log.Fields{
 				"artifact":     artifactPath,
 				"artifact_key": artifactKey,
 				"att_key":      attestationKey,
-			}).Info("Skipping attestation upload (artifact and attestation already exist)")
+			}).Info("Skipping artifact and attestation upload (already exist)")
+
+			// Still upload SBOM files if missing
+			u.uploadSBOMFiles(ctx, artifactPath, artifactKey)
 			return nil
 		}
 
@@ -133,6 +136,9 @@ func (u *ArtifactUploader) UploadArtifactWithAttestation(ctx context.Context, ar
 			"artifact_key": artifactKey,
 			"att_key":      attestationKey,
 		}).Info("Successfully uploaded attestation")
+
+		// Also upload SBOM files if missing
+		u.uploadSBOMFiles(ctx, artifactPath, artifactKey)
 		return nil
 	}