SBOM: subpipelines do not end up in SBOM

[xnox]

Nested pipelines do not end up in sbom. Observe that fetch pipeline is not in SBOM.

package:
  name: bash
  version: 5.2.37
  epoch: 1
  description: "GNU bourne again shell"
  copyright:
    - license: GPL-3.0-or-later

environment:
  contents:
    packages:
      - busybox
      
pipeline:
  - pipeline:
      - uses: fetch
        with:
          uri: https://ftp.fu-berlin.de/unix/gnu/bash/bash-${{package.version}}.tar.gz
          expected-sha256: 9599b22ecd1d5787ad7d3b7bf0c59f312b3396d1e281175dd1f8a4014da621ff

make clean; make package/bash; tar xfO packages/x86_64/bash-5.2.37-r1.apk var/lib/db/sbom/bash-5.2.37-r1.spdx.json

{
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "apk-bash-5.2.37-r1",
  "spdxVersion": "SPDX-2.3",
  "creationInfo": {
    "created": "2024-10-07T15:57:39Z",
    "creators": [
      "Tool: melange (v0.14.2)",
      "Organization: Chainguard, Inc"
    ],
    "licenseListVersion": "3.22"
  },
  "dataLicense": "CC0-1.0",
  "documentNamespace": "https://spdx.org/spdxdocs/chainguard/melange/f51e9601840bbdfaba8356cc7e3215cc62f448dc",
  "documentDescribes": [
    "SPDXRef-Package-bash-5.2.37-r1"
  ],
  "packages": [
    {
      "SPDXID": "SPDXRef-Package-bash-5.2.37-r1",
      "name": "bash",
      "versionInfo": "5.2.37-r1",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "GPL-3.0-or-later",
      "downloadLocation": "NOASSERTION",
      "originator": "Organization: Wolfi",
      "supplier": "Organization: Wolfi",
      "copyrightText": "\n",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceLocator": "pkg:apk/wolfi/[email protected]?arch=x86_64",
          "referenceType": "purl"
        }
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-bash.yaml-718aef48c177537001f1efc81df930795c4e4d11",
      "name": "bash.yaml",
      "versionInfo": "718aef48c177537001f1efc81df930795c4e4d11",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "NOASSERTION",
      "downloadLocation": "NOASSERTION",
      "originator": "Organization: Wolfi",
      "supplier": "Organization: Wolfi",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceLocator": "pkg:github/wolfi-dev/os@718aef48c177537001f1efc81df930795c4e4d11#bash.yaml",
          "referenceType": "purl"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-Package-bash-5.2.37-r1",
      "relationshipType": "DESCRIBED_BY",
      "relatedSpdxElement": "SPDXRef-Package-bash.yaml-718aef48c177537001f1efc81df930795c4e4d11"
    }
  ]
}