ci: install Syft to generate SBOMs on releases

Author: pandatix

.github/workflows/goreleaser.yaml

@@ -20,6 +20,9 @@ jobs:
         with:
           go-version-file: 'go.mod'
           cache: true
+      - name: Install Syft
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
       - name: Import GPG key
         uses: crazy-max/ghaction-import-gpg@v6
         id: import_gpg