[Feature]: Add  GetClangVersion.yaml  /  AddClangPackage.yaml  workflows (Clang / LLVM, e.g. Arm Toolchain for Embedded) #45

Problem Statement

SpdxWorkflows currently provides version-discovery and SPDX-package workflows for .NET SDK, GCC, MSBuild, NuGet, VSTest, and IAR EW ARM — but not for Clang/LLVM. We're adding a Clang-based embedded build (Arm Toolchain for Embedded, aka ATfE — LLVM/Clang packaged for  arm-none-eabi  targets) alongside our existing IAR EWARM toolchain, and there's no way to attribute the Clang compiler in our generated SBOM the way  GetIarEwArmVersion.yaml / AddIarEwArmPackage.yaml  let us attribute IAR.

Proposed Solution

Add two workflows mirroring the GCC pair:

•  GetClangVersion.yaml  — runs  clang --version  (ideally accepting a configurable  path  parameter like  GetIarEwArmVersion.yaml  does, since Clang is often invoked from a vendor distribution rather than a system PATH binary) and emits a  version  output.
•  AddClangPackage.yaml  — adds a Clang/LLVM SPDX package entry (name, version, supplier "LLVM Project", download location) to an SPDX document, mirroring  AddGccPackage.yaml .

Alternatives Considered

Reusing  GetGccVersion.yaml / AddGccPackage.yaml  — doesn't work because Clang's  --version  output format and package identity (LLVM Project vs. GNU) differ from GCC's, so the SBOM would misattribute the build tool.

Usage Examples

- command: run-workflow
  displayName: Query Clang Version
  inputs:
    url: https://raw.githubusercontent.com/demaconsulting/SpdxWorkflows/main/GetClangVersion.yaml
    parameters:
      path: ${{ environment.ATFE_PATH }}
    outputs:
      version: clang-version

- command: run-workflow
  displayName: Add Clang Package ${{ clang-version }}
  inputs:
    url: https://raw.githubusercontent.com/demaconsulting/SpdxWorkflows/main/AddClangPackage.yaml
    parameters:
      spdx: ${{ spdx }}
      id: SPDXRef-Package-Clang-${{ clang-version }}
      version: ${{ clang-version }

Benefits

Lets projects that cross-compile with Clang/LLVM (directly or via vendor distributions like ATfE) accurately record their compiler in an NTIA-compliant SBOM, the same way GCC and IAR users already can.

Priority

Medium - Would improve my workflow

Willingness to Contribute

Yes, with guidance from maintainers

Additional Context

Use case is cross-compiling Cortex-M firmware with community Clang via Arm Toolchain for Embedded (https://github.com/arm/arm-toolchain) as an alternative to IAR EWARM.

Checklist

• I have searched existing issues to ensure this is not a duplicate
• I have provided a clear description of the feature
• I have explained why this feature would be useful