Make the SBOM checks opt-out

Signed-off-by: Matt Moore <[email protected]>

main.tf

@@ -35,7 +35,7 @@ locals {
 }
 
 data "oci_exec_test" "check-sbom" {
-  for_each = local.archs
+  for_each = var.check_sbom ? local.archs : []
   digest   = apko_build.this.sboms[each.key].digest
 
   # Run the supplied NTIA checker over the SBOM files mounted into the checker image in a readonly mode.

variables.tf

@@ -23,6 +23,11 @@ variable "default_annotations" {
   description = "Default annotations to apply to this image."
 }
 
+variable "check_sbom" {
+  default     = true
+  description = "Whether to run the NTIA conformance checker on the SBOMs we are attesting."
+}
+
 variable "sbom_checker" {
   default     = "cgr.dev/chainguard/ntia-conformance-checker:latest"
   description = "The NTIA conformance checker image to use to validate SBOMs."