feat: native sbom generation for hcp (#13566)

* add configuration fields to SBOMInternalProvisioner

* add os detection

* move implementation to hcp-sbom

* upload scanner binary and execute

* use latest syft version always

* reduce duplicate code

* rename config fields appropriately

* default to cyclonedx

* add syft dependency

* add support for elevated user for windows

* add retry for download

* add syft dependency
Updates go version

* optimization for windows

* improve docs

* update config usage rules

* add unit tests

* update golang version, fix linter issues

* refactor and improvements

* simplify few lines

* refactor retry for scanner download

* resolved conflicts

* resolve conflicts from main

* stick to syft v1 for compatibility

* fix lint issues

* stricter version check for syft

* fix version eg

* update go version to 1.25.7

* go mod changes

Author: anurag5sh

.go-version

@@ -1 +1 @@
-1.24.0
+1.25.7

.golangci.yml

@@ -1,6 +1,8 @@
 # Copyright IBM Corp. 2013, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
+version: 2
+
 issues:
   # List of regexps of issue texts to exclude, empty list by default.
   # But independently from this option we use default exclude patterns,
@@ -34,15 +36,17 @@ linters:
   disable-all: true
   enable:
     - errcheck
-    - goimports
-    - gosimple
     - govet
     - ineffassign
     - staticcheck
     - unconvert
     - unused
   fast: true
 
+formatters:
+  enable:
+    - goimports
+
 # options for analysis running
 run:
   # default concurrency is a available CPU number
@@ -94,7 +98,9 @@ run:
 # output configuration options
 output:
   # colored-line-number|line-number|json|tab|checkstyle|code-climate, default is "colored-line-number"
-  format: colored-line-number
+  formats:
+    colored-line-number:
+      path: stdout
 
   # print lines of code with issue, default is true
   print-issued-lines: true

Makefile

@@ -55,7 +55,7 @@ install-gen-deps: ## Install dependencies for code generation
 
 install-lint-deps: ## Install linter dependencies
 	@echo "==> Updating linter dependencies..."
-	@curl -sSfL -q https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin v1.64.8
+	@curl -sSfL -q https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(GOPATH)/bin v2.11.3
 
 dev: ## Build and install a development build
 	@grep 'const VersionPrerelease = ""' version/version.go > /dev/null ; if [ $$? -eq 0 ]; then \

go.mod

@@ -9,14 +9,13 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"time"
 
 	hcpSbomProvisioner "github.com/hashicorp/packer/provisioner/hcp-sbom"
 
 	hcpPackerModels "github.com/hashicorp/hcp-sdk-go/clients/cloud-packer-service/stable/2023-01-01/models"
 	"github.com/klauspost/compress/zstd"
 
-	"time"
-
 	"github.com/hashicorp/hcl/v2/hcldec"
 	packersdk "github.com/hashicorp/packer-plugin-sdk/packer"
 	"github.com/hashicorp/packer-plugin-sdk/packerbuilderdata"
@@ -254,8 +253,15 @@ type SBOMInternalProvisioner struct {
 	SBOMName       string
 }
 
-func (p *SBOMInternalProvisioner) ConfigSpec() hcldec.ObjectSpec { return p.ConfigSpec() }
-func (p *SBOMInternalProvisioner) FlatConfig() interface{}       { return p.FlatConfig() }
+func (p *SBOMInternalProvisioner) ConfigSpec() hcldec.ObjectSpec { return p.Provisioner.ConfigSpec() }
+func (p *SBOMInternalProvisioner) FlatConfig() interface{} {
+	// Try to delegate to inner provisioner if it implements FlatConfig
+	if fc, ok := p.Provisioner.(interface{ FlatConfig() interface{} }); ok {
+		return fc.FlatConfig()
+	}
+	return nil
+}
+
 func (p *SBOMInternalProvisioner) Prepare(raws ...interface{}) error {
 	return p.Provisioner.Prepare(raws...)
 }
@@ -264,6 +270,7 @@ func (p *SBOMInternalProvisioner) Provision(
 	ctx context.Context, ui packersdk.Ui, comm packersdk.Communicator,
 	generatedData map[string]interface{},
 ) error {
+	// Original implementation - all logic now in hcp-sbom provisioner
 	cwd, err := os.Getwd()
 	if err != nil {
 		return fmt.Errorf("failed to get current working directory for Packer SBOM: %s", err)
@@ -297,6 +304,11 @@ func (p *SBOMInternalProvisioner) Provision(
 	if err != nil {
 		return fmt.Errorf("failed to open Packer SBOM file %q: %s", tmpFileName, err)
 	}
+	defer func() {
+		if err := packerSbom.Close(); err != nil {
+			log.Printf("[WARN] Failed to close Packer SBOM file: %s", err)
+		}
+	}()
 
 	provisionerOut := &hcpSbomProvisioner.PackerSBOM{}
 	err = json.NewDecoder(packerSbom).Decode(provisionerOut)