Skip to content

Adds PyPi and fix SBOM generation #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vpetersson merged 2 commits into from
Jan 18, 2026
Merged

Adds PyPi and fix SBOM generation #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
50e5997
Adds PyPi and fix SBOM generation
vpetersson Jan 18, 2026
dc365b3
More pypi fixes
vpetersson Jan 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 98 additions & 0 deletions .github/workflows/pypi.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
---
name: Publish Python distribution to PyPI and TestPyPI

on:
release:
types: [published]
push:
branches:
- master

jobs:
build-and-publish-testpypi:
name: Build and publish to TestPyPI
runs-on: ubuntu-latest
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
environment:
name: testpypi
url: https://test.pypi.org/p/sbomify-action
permissions:
id-token: write # IMPORTANT: mandatory for trusted publishing

steps:
- uses: actions/checkout@v4
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.x"

- name: Determine version
id: version
run: |
# Get base version from pyproject.toml and append dev suffix with short SHA
BASE_VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
# Use .devN format where N is derived from SHA (convert hex to decimal, truncate)
DEV_NUM=$(printf "%d" 0x${SHORT_SHA} 2>/dev/null | cut -c1-9)
VERSION="${BASE_VERSION}.dev${DEV_NUM}"
echo "version=${VERSION}" >> $GITHUB_OUTPUT
echo "Building version: ${VERSION}"

- name: Update version in pyproject.toml
run: |
sed -i "s/^version = [\"'].*/version = \"${{ steps.version.outputs.version }}\"/" pyproject.toml
echo "Updated pyproject.toml:"
grep '^version = ' pyproject.toml

- name: Install UV
run: |
curl -LsSf https://astral.sh/uv/install.sh | sh
echo "$HOME/.local/bin" >> $GITHUB_PATH

- name: Build a binary wheel and a source tarball
run: |
Copy link

Copilot AI Jan 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The --frozen flag requires an exact lock file match, which may cause build failures if the lock file is out of sync. Consider using uv sync without --frozen or adding a verification step to ensure the lock file is up to date before building.

Suggested change
run: |
run: |
uv lock

Copilot uses AI. Check for mistakes.
uv sync --frozen
rm -rf dist/
uv build

- name: Publish distribution to TestPyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
repository-url: https://test.pypi.org/legacy/

build-and-publish-pypi:
name: Build and publish to PyPI
runs-on: ubuntu-latest
if: github.event_name == 'release'
environment:
name: pypi
url: https://pypi.org/p/sbomify-action
permissions:
id-token: write # IMPORTANT: mandatory for trusted publishing

steps:
- uses: actions/checkout@v4
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.x"

- name: Install UV
run: |
curl -LsSf https://astral.sh/uv/install.sh | sh
echo "$HOME/.local/bin" >> $GITHUB_PATH

- name: Build a binary wheel and a source tarball
run: |
uv sync --frozen
rm -rf dist/
uv build

- name: Publish distribution to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
Loading