The v0.0.92 craft-sbom.json artifact has no components or dependencies at all. The workflow step called “Merge SBOMs” writes only root metadata instead of merging the full Syft inventory (717 components, 413 dependency records in that run) with its Zig/platform supplements. The Zig supplement also has a hardcoded 0.0.1 root version and a literal unevaluated $(date ...) timestamp.
The attachment fix in #294 will make these documents available to release consumers, so the named combined SBOM must preserve the actual dependency inventory and graph. Generate it with JSON-aware code, use the repository release version and a real timestamp for supplementary documents, and test that component references and dependency relationships survive the merge.