From 61eee3099f86b3f9f9bd322d91942e157454b8da Mon Sep 17 00:00:00 2001 From: Dan Wolfson Date: Wed, 16 Sep 2026 11:35:13 -0500 Subject: [PATCH] fix(ci): keep SBOM output out of dist/ so PyPI publish doesn't choke on it pypa/gh-action-pypi-publish globs dist/* by default and tries to upload every file there to PyPI as a distribution artifact. The "Generate SBOM" step (added in #368) wrote bom.json/bom.xml straight into dist/ alongside the real wheel/sdist, so the publish step's pre-upload check failed on bom.json ("InvalidDistribution: Unknown distribution format") and aborted before uploading anything -- confirmed live on the v6.1.16 tag push, the first release run since that step was added. Write the SBOM to its own sbom/ directory instead, and attach both dist/* and sbom/* to the GitHub Release. Signed-off-by: Dan Wolfson Co-Authored-By: Claude Sonnet 5 Signed-off-by: Dan Wolfson --- .github/workflows/release.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1128ee6a..b5132709 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -67,9 +67,16 @@ jobs: run: uv build - name: Generate SBOM + # Written outside dist/ -- pypa/gh-action-pypi-publish globs dist/* + # by default and uploads everything there to PyPI as a distribution + # file; a bom.json/bom.xml alongside the wheel/sdist fails that + # upload with "InvalidDistribution: Unknown distribution format" + # (confirmed live on the v6.1.16 release run, the first tag pushed + # since this step was added in #368 -- never exercised before). run: | - uvx --from cyclonedx-bom cyclonedx-py environment --output-format json --output-file dist/bom.json - uvx --from cyclonedx-bom cyclonedx-py environment --output-format xml --output-file dist/bom.xml + mkdir -p sbom + uvx --from cyclonedx-bom cyclonedx-py environment --output-format json --output-file sbom/bom.json + uvx --from cyclonedx-bom cyclonedx-py environment --output-format xml --output-file sbom/bom.xml - name: Publish to PyPI # release/v1 is a floating branch, not a tag -- pypa's own convention @@ -84,7 +91,9 @@ jobs: - name: Create GitHub Release uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: - files: dist/* + files: | + dist/* + sbom/* generate_release_notes: true draft: false prerelease: false