有个小小的建议，希望增加一个参数，能直接在本地输出扫描项目全量的SBOM。感谢

According to the Cobra documentation, Cobra supports examples. I think we should use these example strings for making in-toto easier to use. This might be something for @alanssitis. Do you want to have a look? :)

Context

From action.yml

encoded_github="$(echo ${GITHUB_CONTEXT} | base64 -w 0)"
encoded_runner="$(echo ${RUNNER_CONTEXT} | base64 -w 0)"

But -w doesn't exist for mac host

base64: invalid option -- w
Usage:	base64 [-hvDd] [-b num] [-i in_file] [-o out_file]
  -h, --help     display this message
  -Dd, --decode   decodes input
  -b, --break    break encode

This will also let us test inter-operatbility.

Overview

Currently, the Phylum CLI binary is signed using minisign and the private key for Phylum. This signature can be verified using the corresponding public key for Phylum:

$ minisign -Vm phylum -P RWT6G44ykbS8GABiLXrJrYsap7FCY77m/Jyi0fgsr/Fsy3oLwU4l0IDf
Signature and comment signature verified
Trusted comment: Phylum - the future of sof