Fix create_tar utility function for dotted paths #19

	name: Generate and upload SBOM

	on:
	push:
	branches:
	- qa/**
	- stable/**

	jobs:
	generate-sbom:
	runs-on: ubuntu-latest
	container:
	image: aquasec/trivy:latest
	options: --entrypoint ""
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up cache
	uses: actions/cache@v4
	with:
	path: .trivycache/
	key: ${{ runner.os }}-trivy-${{ hashFiles('requirements*.txt') }}
	restore-keys: \|
	${{ runner.os }}-trivy-

	- name: Generate SBOM
	run: trivy fs --cache-dir .trivycache --format cyclonedx --file-patterns "pip:requirements.*\.txt" --include-dev-deps --output sbom.xml .
	env:
	TRIVY_NO_PROGRESS: "true"

	- name: Upload SBOM artifact
	uses: actions/upload-artifact@v4
	with:
	name: sbom
	path: sbom.xml

	upload-sbom:
	needs: generate-sbom
	runs-on: ubuntu-latest
	steps:
	- name: Download SBOM artifact
	uses: actions/download-artifact@v4
	with:
	name: sbom

	- name: Upload SBOM
	run: \|
	curl -v -X 'POST' "${{ secrets.DEPENDENCY_TRACK_URL }}/api/v1/bom" \
	-H "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}" \
	-H "Content-Type: multipart/form-data" \
	-F "autoCreate=true" \
	-F "projectName=${{ github.repository }}" \
	-F "projectVersion=${{ github.ref_name }}" \
	-F "parentName=Archivematica" \
	-F "[email protected]"
	env:
	DEPENDENCY_TRACK_URL: ${{ secrets.DEPENDENCY_TRACK_URL }}
	DEPENDENCY_TRACK_API_KEY: ${{ secrets.DEPENDENCY_TRACK_API_KEY }}

Provide feedback