[rajnisht7]

What

Wraps the anchore/sbom-action step in sbom.yml with a retry (3 attempts) and makes it non-blocking, since the job was failing on a transient GitHub release-CDN 504 when downloading Syft.

Why

main branch CI is failing on sbom.yml with received HTTP status=504 while downloading Syft’s checksums file, a transient GitHub-side timeout, not a missing asset or config issue. The install script has no retry logic, so a single blip kills the whole job

Security impact

None

Test plan

• pytest passes
• ruff check passes
• mypy passes
• Manual test performed (describe steps below if applicable)

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!