Added SBOM generation to CD workflow.

.gitea/workflows/cd.yml

@@ -2,7 +2,6 @@ name: CD
 
 on:
   push:
-    branches: [master]
     tags: ["v*"]
 
 permissions:
@@ -13,8 +12,8 @@ env:
   UV_PYTHON_DOWNLOADS: never
 
 jobs:
-  build:
-    name: Build
+  publish:
+    name: Publish
     runs-on: logaldeveloper-archlinux-ci
     steps:
       - name: Checkout repository
@@ -22,38 +21,55 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Cache uv packages
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ~/.cache/uv
-          key: uv-${{ hashFiles('uv.lock') }}
-
       - name: Install dependencies
-        run: uv sync --locked
+        run: uv sync --locked --no-dev
 
-      - name: Compute version
-        id: version
+      - name: Generate package metadata
+        id: metadata
         run: |
-          version=$(uv run hatch version)
-          echo "version=$version"
-          echo "version=$version" >> "$GITEA_OUTPUT"
+          version="${{ gitea.ref_name }}"
+          version="${version#v}"
+          printf 'version=%s\n' "$version" | tee -a "$GITEA_OUTPUT"
 
       - name: Write version into maubot.yaml
         run: |
-          sed -i "s/^version: .*/version: ${{ steps.version.outputs.version }}/" maubot.yaml
+          sed -i "s/^version: .*/version: ${{ steps.metadata.outputs.version }}/" maubot.yaml
           grep "^version:" maubot.yaml
 
       - name: Build plugin
-        run: 7z a -tzip -mx=9 -xr!__pycache__ owncastsentry-v${{ steps.version.outputs.version }}.mbp owncastsentry/ maubot.yaml base-config.yaml LICENSE.txt
+        run: 7z a -tzip -mx=9 -xr!__pycache__ owncastsentry-v${{ steps.metadata.outputs.version }}.mbp owncastsentry/ maubot.yaml base-config.yaml LICENSE.txt
 
       - name: Print artifact checksums
         run: |
-          echo "MD5: $(md5sum owncastsentry-v${{ steps.version.outputs.version }}.mbp)"
-          echo "SHA1: $(sha1sum owncastsentry-v${{ steps.version.outputs.version }}.mbp)"
-          echo "SHA256: $(sha256sum owncastsentry-v${{ steps.version.outputs.version }}.mbp)"
+          echo "MD5: $(md5sum owncastsentry-v${{ steps.metadata.outputs.version }}.mbp)"
+          echo "SHA1: $(sha1sum owncastsentry-v${{ steps.metadata.outputs.version }}.mbp)"
+          echo "SHA256: $(sha256sum owncastsentry-v${{ steps.metadata.outputs.version }}.mbp)"
+
+      - name: Generate SBOM
+        env:
+          SYFT_CHECK_FOR_APP_UPDATE: "false"
+        run: |
+          syft scan dir:.venv \
+            --override-default-catalogers python-installed-package-cataloger \
+            --select-catalogers=-file \
+            --source-name git.logal.dev/LogalDeveloper/OwncastSentry \
+            --source-version "${{ steps.metadata.outputs.version }}" \
+            --output syft-table \
+            --output cyclonedx-json=owncastsentry-${{ steps.metadata.outputs.version }}.cyclonedx.json
+          sha256sum owncastsentry-${{ steps.metadata.outputs.version }}.cyclonedx.json
+          zstd -T0 --ultra -22 \
+            owncastsentry-${{ steps.metadata.outputs.version }}.cyclonedx.json
 
       - name: Upload plugin artifact
         uses: https://github.com/christopherhx/gitea-upload-artifact@8818363695ca2d5782c64f6453273341374767b7 # v7
         with:
-          path: owncastsentry-v${{ steps.version.outputs.version }}.mbp
-          archive: false
+          path: owncastsentry-v${{ steps.metadata.outputs.version }}.mbp
+          archive: "false"
+
+      - name: Upload SBOM artifact
+        uses: https://github.com/christopherhx/gitea-upload-artifact@8818363695ca2d5782c64f6453273341374767b7 # v7
+        with:
+          name: owncastsentry-cyclonedx-${{ steps.metadata.outputs.version }}
+          path: owncastsentry-${{ steps.metadata.outputs.version }}.cyclonedx.json.zst
+          if-no-files-found: error
+          archive: "false"