[sbom]: Skip Syft scan for armhf builds

[lunyue-ms]

Why I did it

ARMHF installer builds with ENABLE_SBOM=y fail in strict mode because Syft v1.44.0 does not publish a Linux ARMHF binary. The retry can then incorrectly succeed from the installer artifact left behind by the failed SBOM step.

This follows up on the SBOM support introduced in #27455.

Work item tracking

• Microsoft ADO (number only):

How I did it

• Use none as the effective scanner when SBOM_SCAN_TOOL=syft and CONFIGURED_ARCH=armhf.
• Keep recipe, observation, and lockfile SBOM inputs enabled, including strict validation of the rootfs and installer containers.
• Remove both the primary Make target and the current variant artifact when SBOM generation fails so retries cannot pass using stale installers.
• Document the ARMHF scanner limitation and update the reviewed slave.mk cache baseline.

How to verify it

1. Configure PLATFORM=marvell-prestera PLATFORM_ARCH=armhf.
2. Build with ENABLE_SBOM=y target/sonic-marvell-prestera-armhf.bin.
3. Verify the installer and CycloneDX SBOM are generated without attempting to install Syft.
4. Verify amd64/arm64 builds continue using Syft.

Static verification completed:

• ARMHF + Syft expands to effective scanner none.
• ARM64 + Syft remains syft.
• Diff and cache-baseline consistency checks pass.

ARMHF installer validation will be performed by CI.

Which release branch to backport (provide reason below if selected)

• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202512
• 202605
• 202608

Tracking issue/work item for backport/cherry-pick request (GitHub issue or Microsoft ADO):
Failure type: other

Tested branch

• master
• 202305
• 202311
• 202405
• 202411
• 202505
• 202511
• 202512
• 202605
• 202608
• N/A

Test result

Static Make expansion checks passed. ARMHF installer build is delegated to CI.

Description for the changelog

Allow strict SBOM generation for ARMHF installers without an unavailable Syft binary.

Link to config_db schema for YANG module changes

N/A

A picture of a cute animal (not mandatory but encouraged)

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

This PR adjusts the SONiC build SBOM pipeline to avoid failing ARMHF installer builds when ENABLE_SBOM=y and SBOM_SCAN_TOOL=syft, since Syft does not provide a Linux ARMHF binary. It introduces an “effective scanner” selection that resolves to none for ARMHF+Syft while keeping other SBOM inputs and strict validation active, and it hardens retry behavior by removing stale installer artifacts on SBOM failure.

Changes:

• Add SBOM_EFFECTIVE_SCAN_TOOL and use it to automatically map syft -> none for CONFIGURED_ARCH=armhf.
• On SBOM generation failure, delete the primary installer target and the currently-built variant artifact to prevent retries from succeeding with stale outputs.
• Document the ARMHF scanner limitation and refresh the reviewed slave.mk cache baseline hash.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
slave.mk	Logs the effective scanner, uses it for SBOM generation, and removes installer artifacts on SBOM failure to avoid stale retry success.
rules/config	Defines SBOM_EFFECTIVE_SCAN_TOOL to auto-disable Syft scanning for ARMHF while preserving the configured SBOM_SCAN_TOOL elsewhere.
README.sbom.md	Documents none as a valid scanner option and explains the ARMHF Syft limitation and resulting behavior.
Makefile.cache	Updates the slave.mk review baseline hash used by the cache guard.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.