Generate sbom

Signed-off-by: Prabhu Subramanian <[email protected]>

.github/workflows/pythonapp.yml

@@ -36,3 +36,11 @@ jobs:
       env:
         PYTHONPATH: .
         TEST_VDB_HOME: vdb_data
+    - name: Use Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22.x'
+    - name: Generate SBOM with cdxgen
+      run: |
+        sudo npm install -g @cyclonedx/cdxgen
+        cdxgen -t python -o bom.json . -p

.github/workflows/pythonpublish.yml

@@ -19,21 +19,31 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install setuptools wheel twine build
-      - name: Create Release
-        id: create_release
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Build
         run: |
           python3 -m build
       - name: Publish package distributions to PyPI
         if: startsWith(github.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1
-
+      - name: Generate SBOM with cdxgen
+        run: |
+          sudo npm install -g @cyclonedx/cdxgen
+          cdxgen -t python -o bom.json .
+      - name: Create Release
+        id: create_release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            bom.json
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}