build(deps): Bump sbomify/github-action from 0.5.0 to 0.6 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: sbomify/github-action.

Updates sbomify/github-action from 0.5.0 to 0.6

Release notes

Sourced from sbomify/github-action's releases.

The one with UV

Major Features

Package Manager Support

• Added uv.lock support: Full support for Python's uv package manager dependency files (#39 by @​vpetersson)
• Added Conan support: Support for Conan C++ package manager with conan.lock files (#40 by @​vpetersson)

SPDX Enhancements

• Comprehensive SPDX augmentation: Implemented full CycloneDX parity for SPDX format SBOMs (#37 by @​vpetersson)
• Fixed SPDX component naming: Corrected COMPONENT_NAME override for SPDX SBOMs (#36 by @​vpetersson)
• Enhanced SPDX metadata: Fixed missing metadata.component.type field (#41 by @​rusko124)

Product Release Management

• Automatic product release management: Added comprehensive release tracking and management (#35 by @​vpetersson)
• SBOM tagging: Implemented automatic tagging of SBOMs with product versions
• Release endpoint improvements: Fixed release endpoint functionality and API URL construction (#38 by @​vpetersson)

Infrastructure & Tooling

Migration to UV

• Poetry to UV migration: Migrated from Poetry to UV for dependency management (#44 by @​vpetersson)
• Removed poetry.lock: Deleted Poetry lockfile (1,366 lines removed)
• Added uv.lock: New UV lockfile with 932 lines of dependencies
• Updated pyproject.toml: Significant updates to project configuration (49 changes)

CI/CD Improvements

• Consolidated workflows: Removed 4 separate GitHub workflow files:
  • docker_build.yaml (29 lines)
  • docker_registry.yaml (57 lines)
  • integration_tests.yaml (96 lines)
  • sanity_checks.yaml (35 lines)
• Enhanced main workflow: Significantly expanded sbomify.yaml (193+ additions)
• Updated deployment flow: Improved release order and deployment process (#45 by @​vpetersson)
• Trivy version bump: Updated Trivy scanner version (#47 by @​vpetersson)

Bug Fixes

API Improvements

• Fixed double API prefix: Prevented double /api/v1 prefix in API URL construction
• Updated requests library: Addressed CVE security vulnerability
• Sentry endpoint update: Switched to new Sentry endpoint (#43 by @​vpetersson)

Testing Enhancements

New Test Coverage

• API endpoint auditing: Added comprehensive API endpoint audit tests (218 lines)
• Release management tests: New release functionality tests (394 lines)
• Enhanced enrichment tests: Expanded SBOM enrichment test coverage (57+ additions)
• JSON augmentation tests: Significantly expanded JSON augmentation tests (353+ additions)
• Configuration tests: Enhanced configuration testing (97+ additions)

... (truncated)

Commits

• c34242c Merge pull request #47 from sbomify/bump-trivy
• e5031a3 Bump trivy (and parlay in CI)
• 8fbf42f Merge pull request #46 from sbomify/cut-0.6
• 98b1cb1 Cut 0.6
• adfec50 Merge pull request #45 from sbomify/fix-release-order
• fc7cd4b Tweaks deployment flow
• e24a0b2 Merge pull request #44 from sbomify/poetry-to-uv
• 1e165f1 Adds proper locking
• d9b84d6 More uv migration
• 906f0c4 UV migration in progress
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions