chore(ci): implement code scanning (#15)

Implement PR code scanning and SBOM on release.

.github/workflows/git-release.yml

@@ -14,6 +14,8 @@ name: Create Release
 jobs:
   create-git-release:
     runs-on: ubuntu-latest
+    outputs:
+      release-tag: v${{ steps.get-version.outputs.version }}
     steps:
       - uses: actions/checkout@v3
 
@@ -43,7 +45,7 @@ jobs:
 
           echo "::set-output name=latestSection::$release_message"
           echo "$release_message"
-      
+
       - id: get-version
         run: echo "::set-output name=version::$(cat $VERSION_FILE)"
 
@@ -59,3 +61,9 @@ jobs:
           tag_name: v${{ steps.get-version.outputs.version }}
           release_name: v${{ steps.get-version.outputs.version }}
           body_path: unescaped-release-notes.md
+
+  release-sbom:
+    needs: create-git-release
+    uses: circlefin/circle-public-github-workflows/.github/workflows/attach-release-assets.yaml@v1
+    with:
+      release_tag: ${{ needs.create-git-release.outputs.release-tag }}