Generate an SPDX SBOM from a source code directory, not a container image, using Syft

Steps

1. Point Syft at the project root using the dir: scheme (e.g. syft dir:.) rather than an image reference, so it scans manifests directly on disk instead of pulling a container.
2. Select SPDX output, e.g. -o spdx-json for SPDX JSON or -o spdx for SPDX tag-value, to match downstream tooling requirements.
3. Rely on Syft's automatic manifest detection (package.json, requirements.txt, pom.xml, go.mod, Cargo.lock, and others) to build the component list without per-ecosystem configuration.
4. Exclude build artifacts and vendored/test directories with exclude glob patterns so the SBOM reflects shipped dependencies rather than local tooling.
5. Feed the resulting SPDX file into a vulnerability scanner or SBOM repository as a source-level baseline, kept separate from any container-image SBOM generated later in the pipeline.