From 9a787819eca698fa545912d39b07b688a5c289fb Mon Sep 17 00:00:00 2001
From: casjay <git-admin@casjaysdev.pro>
Date: Fri, 3 Jul 2026 12:37:23 -0400
Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20Add=20go-licenses=20and=20cyclonedx?=
 =?UTF-8?q?-gomod=20to=20image=20=E2=9C=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Install go-licenses (dependency license scanner) and cyclonedx-gomod
(CycloneDX SBOM generator) via the go-tools build stage alongside the
other compiled tools.
- Dockerfile: add go install for go-licenses and cyclonedx-gomod in the go-tools stage
- README.md: add License & SBOM section to the included tools table

Dockerfile
README.md
---
 Dockerfile | 4 +++-
 README.md  | 7 +++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 8d42dc2..1cac153 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,7 +46,9 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install golang.org/x/tools/cmd/goim
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/google/wire/cmd/wire@latest && \
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install go.uber.org/mock/mockgen@latest && \
     GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/protobuf/cmd/protoc-gen-go@latest && \
-    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/google/go-licenses@latest && \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
 
 FROM ${PULL_URL}:${DISTRO_VERSION} AS build
 ARG TZ
diff --git a/README.md b/README.md
index c9f8b36..68e7bf6 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,13 @@ volumes:
 | `ko` | Build Go container images without a Dockerfile |
 | `air` | Live-reload dev server for iterative development |
 
+### License & SBOM
+
+| Tool | Purpose |
+|------|---------|
+| `go-licenses` | Scan all dependencies and report their licenses |
+| `cyclonedx-gomod` | Generate a CycloneDX SBOM from a Go module |
+
 ### Language server
 
 | Tool | Purpose |