Skip to content

PyPI publication workflow: Generate package SBOM in wheel - #140

Merged
JPEWdev merged 11 commits into
JPEWdev:mainfrom
bact:gen-sbom
Aug 19, 2026
Merged

PyPI publication workflow: Generate package SBOM in wheel#140
JPEWdev merged 11 commits into
JPEWdev:mainfrom
bact:gen-sbom

Conversation

@bact

@bact bact commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Add Pitloom GitHub Action to generates SBOM and put it in the wheel for publication on PyPI.

@bact
Add Pitloom to generate package SBOM in wheel
2fb7824 
Add "pitllom" to Hatchling build hook to get SBOM and put it in the wheel.

Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact bact added enhancement New feature or request documentation Improvements or additions to documentation labels Aug 11, 2026
@bact
bact marked this pull request as draft August 11, 2026 14:20
@bact

bact commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator Author

Python 3.9 is not supported yet.
May need to revise Pitloom to lower its Python version requirement.

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

Coverage report

This PR does not seem to contain any modification to coverable code.

@bact
Update hatchling version requirement to 1.29.0
8d5ca6a 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact

bact commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator Author

Hatchling's SBOM embedding feature is only from Hatchling 1.29.0, which requires Python >= 3.10. So even Pitloom can generate the SBOM, but Hatchling will not embed the file in the wheel.

@bact

bact commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator Author

Will see if we can inject the SBOM manually.
If we can lower Hatchling requirement to 1.27, we can support Python 3.9

bact added 6 commits August 11, 2026 17:34
@bact
Merge branch 'JPEWdev:main' into gen-sbom
ee278ae
@bact
Merge branch 'JPEWdev:main' into gen-sbom
cad1798
@bact
Use Pitloom GitHub Action instead of Hatchling hook
49e3673 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact
Enable content-type scan
0f28686 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact
Update Pitloom to 0.16.0
d7259d4 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact
Update pitloom action version to v0.16.1
f172589 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact

bact commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Switch to Pitloom GitHub Action, which works with Python < 3.10.

See wheels (*.whl) from these packages for examples of generated SBOM by Pitloom

(SBOM quality are vary by dependencies and types of files in the project. The sentimentdemo is worst, as there are lot of text files without version information.)

@bact
bact requested a review from JPEWdev August 18, 2026 13:24
bact added 2 commits August 18, 2026 14:29
@bact
Enable content-type detection
c90a09f 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact
Remove content-type config from pyproject.toml
1ed1771 
Better put it only during CI

Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact
bact removed the request for review from JPEWdev August 18, 2026 13:32
@bact
bact marked this pull request as ready for review August 18, 2026 13:38
@bact bact changed the title Add Pitloom to generate package SBOM in wheel PyPI publication workflow: Generate package SBOM in wheel Aug 18, 2026
@bact
bact requested a review from JPEWdev August 18, 2026 13:41
JPEWdev
JPEWdev reviewed Aug 18, 2026
View reviewed changes
Comment thread .github/workflows/publish.yaml
embed-wheel: "dist/*.whl"
extras: "content-type"
content-type: "true"

@JPEWdev JPEWdev Aug 18, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we run this during the normal build workflow also so there are no surprises when we publish?

@bact bact Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes we can. Will update the test.yml for that. Or maybe a dedicated SBOM generation test workflow.

@bact bact Aug 19, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.github/workflows/test-sbom.yaml is now added to run for every PR.

@bact
Add test-sbom.yml
1938b36 
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
@bact
bact requested a review from JPEWdev August 19, 2026 18:33
@JPEWdev
JPEWdev merged commit a598c79 into JPEWdev:main Aug 19, 2026
11 checks passed
@bact
bact deleted the gen-sbom branch August 20, 2026 06:15
@bact bact added the tests Tests, test spec, test data label Aug 20, 2026
@bact bact linked an issue Aug 20, 2026 that may be closed by this pull request
Generate SBOM for shacl2code wheel #139
Closed
@bact bact mentioned this pull request Aug 20, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JPEWdev JPEWdev JPEWdev approved these changes

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation enhancement New feature or request tests Tests, test spec, test data

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Generate SBOM for shacl2code wheel

2 participants

@bact @JPEWdev