feat: sytf, gomod proxy, source enabled

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

.github/workflows/build.yml

@@ -23,7 +23,7 @@ jobs:
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
-
+      - uses: anchore/sbom-action/download-syft@v0.6.0 # installs syft
       - uses: docker/login-action@v1
         with:
           registry: ghcr.io

.goreleaser.yaml

@@ -31,6 +31,12 @@ changelog:
       - '^docs:'
       - '^test:'
 
+source:
+  enabled: true
+
+gomod:
+  proxy: true
+
 dockers:
   - image_templates:
     - 'ghcr.io/goturkiye/goreleaser-supply-chain-example:{{ .Tag }}'
@@ -42,3 +48,8 @@ dockers:
     - "--label=org.opencontainers.image.revision={{.FullCommit}}"
     - "--label=org.opencontainers.image.version={{.Version}}"
     - "--label=org.opencontainers.image.source={{.GitURL}}"
+
+sboms:
+  - artifacts: archive
+  - id: source
+    artifacts: source