syfy dep and sbom for image

Signed-off-by: Kavindu Dodanduwa <kavindudodanduwa@gmail.com>

.github/workflows/release-please.yaml

@@ -55,9 +55,11 @@ jobs:
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@master
+
       - name: Get current date
         id: date
         run: echo "::set-output name=date::$(date +'%Y-%m-%d')"
+
       - name: Build
         uses: docker/build-push-action@37abcedcc1da61a57767b7588cb9d03eb57e28b3 # v3
         with:
@@ -75,6 +77,11 @@ jobs:
             COMMIT=${{ github.sha }}
             DATE=${{ steps.date.outputs.date }}
 
+      - name: SBOM for latest image
+        uses: anchore/sbom-action@v0
+        with:
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release-please.outputs.release_tag_name }}
+          artifact-name: ${{ format('{0}-{1}-sbom.spdx',env.IMAGE_NAME, needs.release-please.outputs.release_tag_name) }}
   go-release:
     needs: release-please
     runs-on: ubuntu-latest
@@ -90,6 +97,9 @@ jobs:
         with:
           go-version: ${{ env.DEFAULT_GO_VERSION }}
 
+      - name: Set up syft
+        uses: anchore/sbom-action/download-syft@v0
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@9754a253a8673b0ea869c2e863b4e975497efd0c # v4
         with: