Add SBOM for release pipeline (#20519) (#20573)

tools/releaseBuild/azureDevOps/releasePipeline.yml

@@ -29,6 +29,12 @@ resources:
     name: Internal-PowerShellTeam-Tools
     ref: main-mirror
 
+  - repository: ComplianceRepo
+    type: github
+    endpoint: ComplianceGHRepo
+    name: PowerShell/compliance
+    ref: master
+
 variables:
   - name: runCodesignValidationInjection
     value : false

tools/releaseBuild/azureDevOps/templates/release-CreateGitHubDraft.yml

@@ -7,13 +7,13 @@ steps:
 - template: release-SetReleaseTagAndContainerName.yml
 
 - pwsh: |
-    Import-module '$(BUILD.SOURCESDIRECTORY)/build.psm1'
+    Import-module '$(BUILD.SOURCESDIRECTORY)/PowerShell/build.psm1'
     Install-AzCopy
   displayName: Install AzCopy
   retryCountOnTaskFailure: 2
 
 - pwsh: |
-    Import-module '$(BUILD.SOURCESDIRECTORY)/build.psm1'
+    Import-module '$(BUILD.SOURCESDIRECTORY)/PowerShell/build.psm1'
     $azcopy = Find-AzCopy
     Write-Verbose -Verbose "Found AzCopy: $azcopy"
 
@@ -54,6 +54,24 @@ steps:
     Write-Verbose -Verbose -Message $fileContent
   displayName: Add sha256 hashes
 
+- checkout: ComplianceRepo
+
+- pwsh: |
+    $releaseVersion = '$(ReleaseTag)' -replace '^v',''
+    $vstsCommandString = "vso[task.setvariable variable=ReleaseVersion]$releaseVersion"
+    Write-Host "sending " + $vstsCommandString
+    Write-Host "##$vstsCommandString"
+  displayName: 'Set release version'
+
+- template: Sbom.yml@ComplianceRepo
+  parameters:
+    BuildDropPath: '$(PackagesRoot)'
+    Build_Repository_Uri: 'https://github.com/powershell/powershell.git'
+    displayName: PowerShell Hashes SBOM
+    packageName: PowerShell Artifact Hashes
+    packageVersion: $(ReleaseVersion)
+    sourceScanPath: '$(PackagesRoot)'
+
 - pwsh: |
     Import-module '$(Pipeline.Workspace)/tools/Scripts/GitHubRelease.psm1'
     $releaseVersion = '$(ReleaseTag)' -replace '^v',''
@@ -68,7 +86,7 @@ steps:
       $semanticVersion.Major.ToString() + "." + $semanticVersion.Minor.ToString() + ".md"
     }
 
-    $filePath = "$env:BUILD_SOURCESDIRECTORY/CHANGELOG/$fileName"
+    $filePath = "$env:BUILD_SOURCESDIRECTORY/PowerShell/CHANGELOG/$fileName"
     Write-Verbose -Verbose "Selected Log file: $filePath"
 
     if (-not (Test-Path $filePath)) {