ci: add generating sboms in docker workflow (#181)

Author: mac641

.github/workflows/docker.yml

@@ -78,11 +78,15 @@ jobs:
         [ "${GITHUB_EVENT_NAME}" == 'release' ] && echo "tag=${GITHUB_REF##*/}" >> $GITHUB_ENV || true
         [ "${GITHUB_EVENT_NAME}" == 'push' ] && echo "tag=latest" >> $GITHUB_ENV || true
 
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
     - name: Build and push image
       uses: docker/build-push-action@v6
       with:
         context: .
         push: true
+        sbom: true
         tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.tag }}
 
   bench:
@@ -118,4 +122,4 @@ jobs:
         external-data-json-path: ./cache/benchmark-data.json
          # GitHub API token to make a commit comment
         github-token: ${{ secrets.GITHUB_TOKEN }}
-        fail-on-alert: true
+        fail-on-alert: true