chore: Augment SBOM on demand

[oarbusi]

Proposed changes

Augments SBOM on demand

Link to any related issue(s): CLOUDP-325043

Type of change:

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as
  expected)
• This change requires a documentation update
• If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Manual QA performed:

• cfn invoke for each of CRUDL/cfn test
• Updated resource in example
• Published to AWS private registry
• Used the template in example to create and update a stack in AWS
• Deleted stack to ensure resources are deleted
• Created multiple resources in same stack
• Validated in Atlas UI
• Included screenshots

Required Checklist:

• I have signed the MongoDB CLA
• I have added tests that prove my fix is effective or that my feature works
• I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
• I have added any necessary documentation (if appropriate)
• I have run make fmt and formatted my code
• For CFN Resources: I have released by changes in the private registry and proved by change
  works in Atlas

Further comments

[Copilot]

Pull Request Overview

Adds on-demand SBOM augmentation by introducing a new script, Makefile target, and GitHub Actions workflow to integrate with Kondukto.

• Introduce augment-sbom.sh for running SBOM augmentation via Docker
• Add augment-sbom target in the Makefile
• Create generate-augmented-sbom.yml workflow for manual dispatch

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
scripts/augment-sbom.sh	New script to wrap a Docker invocation of Kondukto
Makefile	Added augment-sbom phony target
.github/workflows/generate-augmented-sbom.yml	Workflow for manual SBOM augmentation and artifact upload

Comments suppressed due to low confidence (2)

.github/workflows/generate-augmented-sbom.yml:31

• [nitpick] Consider using a versioned checkout action (e.g., actions/checkout@v3) rather than a fixed SHA to improve clarity and maintainability.

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

.github/workflows/generate-augmented-sbom.yml:33

• [nitpick] The actions/setup-go step isn’t required for a Bash-based SBOM augmentation; removing it could reduce workflow startup time.

- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5