Where in the current ONAP Release Package should Software BOMs be placed?

We looked at the structure of releases. There isn't a bundled release per se. In other words there isn't a single archive that contains all the code / binaries for a release like Casablanca or say Honolulu. Each release is by project. So current thinking is that a BOM should be created per project. and included in the GitHub repo.