Sign the generated BOMs

Signed-off-by: Prabhu Subramanian <[email protected]>

Author: prabhu

.github/workflows/image-build.yml

@@ -88,7 +88,7 @@ jobs:
           labels: ${{ steps.cdxgen-metadata.outputs.labels }}
       - name: save private key to file
         run: |
-          echo $SBOM_SIGN_PRIVATE_KEY_DATA > $GITHUB_WORKSPACE/private.key
+          echo "$SBOM_SIGN_PRIVATE_KEY_DATA" > $GITHUB_WORKSPACE/private.key
           ls -lh $GITHUB_WORKSPACE/private.key
         env:
           SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}

.github/workflows/npm-release.yml

@@ -126,7 +126,7 @@ jobs:
       continue-on-error: true
     - name: save private key to file
       run: |
-        echo $SBOM_SIGN_PRIVATE_KEY_DATA > $GITHUB_WORKSPACE/private.key
+        echo "$SBOM_SIGN_PRIVATE_KEY_DATA" > $GITHUB_WORKSPACE/private.key
       env:
         SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
     - name: Attach cdx sbom
@@ -185,7 +185,7 @@ jobs:
           labels: ${{ steps.meta2.outputs.labels }}
       - name: save private key to file
         run: |
-          echo $SBOM_SIGN_PRIVATE_KEY_DATA > $GITHUB_WORKSPACE/private.key
+          echo "$SBOM_SIGN_PRIVATE_KEY_DATA" > $GITHUB_WORKSPACE/private.key
         env:
           SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
       - name: Attach cdx sbom
@@ -255,7 +255,7 @@ jobs:
         labels: ${{ steps.meta2.outputs.labels }}
     - name: save private key to file
       run: |
-        echo $SBOM_SIGN_PRIVATE_KEY_DATA > $GITHUB_WORKSPACE/private.key
+        echo "$SBOM_SIGN_PRIVATE_KEY_DATA" > $GITHUB_WORKSPACE/private.key
       env:
         SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
     - name: Attach cdx sbom
@@ -371,7 +371,7 @@ jobs:
         labels: ${{ steps.meta5.outputs.labels }}
     - name: save private key to file
       run: |
-        echo $SBOM_SIGN_PRIVATE_KEY_DATA > $GITHUB_WORKSPACE/private.key
+        echo "$SBOM_SIGN_PRIVATE_KEY_DATA" > $GITHUB_WORKSPACE/private.key
       env:
         SBOM_SIGN_PRIVATE_KEY_DATA: ${{ secrets.SBOM_SIGN_PRIVATE_KEY }}
     - name: Attach cdx sbom