[WaleedMahamid]

Summary

Running cycodelabs/cimon-action on a windows-2022 runner fails with Error: unknown command "agent" for "cimon-attest", and nothing in the action or its docs explains how to get an SBOM for an application built on Windows. The Windows release of cimon is an attest-only build (a single cimon.exe, no agent command), and the agent that generates SBOMs automatically is eBPF-based and Linux-only.

Three commits:

1. fix: fail fast on non-Linux runners, document the Linux-only agent

• src/main/index.js: throw an explanatory error before downloading anything when process.platform !== 'linux', pointing at cycodelabs/cimon-action/attest@v1. Goes through the existing catch so fail-on-error applies as for any other startup error (with the default false the step logs the error and continues).
• src/post/index.js: skip the stop call on non-Linux runners instead of trying to run the Linux install script.
• README.md: new Supported platforms table; action.yml description says Linux only.

2. feat(attest): sbom input to sign a tool-generated SBOM attestation

cimon v1.0.27 ships cimon attest sbom, which wraps an SBOM produced by another tool (CycloneDX JSON/XML, SPDX 2.x JSON/YAML/tag-value) in a signed in-toto attestation over the build artifacts. On Windows/macOS this is the only way to get an SBOM attestation.

• New inputs sbom and signed-sbom-output (default sbom.intoto.jsonl.sig), new step output signed-sbom-path.
• When sbom is set, runs cimon attest sbom after generate-and-sign over the same subjects with the same key / keyless / timestamp flags. Backend and signing flags are factored into backendArgs() / signingArgs() shared by both subcommands.
• The signed SBOM is uploaded as a workflow artifact when report-artifact is on.
• attest/README.md: new SBOM attestation section with a Windows example and the matching cimon attest verify --type sbom command; inputs/outputs tables updated.
• verify-pr.yaml: the existing verify-attest-windows job now passes a minimal CycloneDX document through the new input.

3. Review follow-ups

• The sbom path is checked only after the provenance run, so a wrong value for this optional input cannot block the provenance attestation.
• README wording for the default fail-on-error: false; action.yml description under 125 characters; credentials added to the attest README examples.
• Note for whichever of this PR and attest: add a kms input for KMS signing, and fix the dist rebuild push #135 merges second: --kms and the key-based timestamp condition belong in signingArgs() so the SBOM attestation is signed the same way.

Test plan

• npm test (41 passing); all three dist/ bundles rebuilt with ncc
• Main and post bundles run on macOS (non-Linux): guard message printed, post step skips
• Attest bundle run against a stub cimon that logs argv: both invocations carry identical signing flags, signed-sbom-path output set, a missing SBOM path errors after the provenance invocation
• verify-attest-windows CI job: real cimon attest sbom run on windows-latest with the repo secrets. This PR comes from a fork, so repo secrets are not available to its CI run; pushing the branch to this repo would let that job run end to end.

🤖 Generated with Claude Code

[WaleedMahamid]

Pushed 8f394fd with a round of follow-ups:

• The sbom path is now checked inside the SBOM block, after the provenance run. A wrong value for this optional input no longer blocks the provenance attestation; with the default fail-on-error: false the provenance still completes and only the SBOM step warns.
• README wording for the non-Linux guard now says the step stops before installing anything and logs an explanatory error, failing only with fail-on-error: true.
• action.yml description shortened to 116 characters for the Marketplace limit.
• attest README: the SBOM, manual attest sbom and attest verify examples now include client-id / secret, with a note on the CIMON_CLIENT_ID / CIMON_SECRET env alternative. The KMS mention in the SBOM section is dropped; --kms is coming in attest: add a kms input for KMS signing, and fix the dist rebuild push #135, and whichever PR merges second should move it (and the key-based timestamp condition) into signingArgs() so both attestations are signed the same way.
• attest/dist rebuilt; npm test passes (41).

Still open: the verify-attest-windows job needs repo secrets, which a fork PR does not get. Happy for a maintainer to push the branch into this repo so it can run end to end.