Implement simple CycloneDX SBOM generation (#1925)

.github/workflows/ci-cd.yml

@@ -134,6 +134,22 @@ jobs:
           name: dist
           path: dist
 
+      - name: Set version
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        run: echo "VERSION=$(echo ${{ github.ref_name }} | sed 's/^v//')" >> $GITHUB_ENV
+
+      - name: Generate SBOM
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        run: |
+          make sbom > holidays-$VERSION-sbom.json
+
+      - name: Upload SBOM
+        if: startsWith(github.event.ref, 'refs/tags/v')
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: holidays-$VERSION-sbom.json
+
   test-build:
     name: Test build on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
@@ -223,8 +239,14 @@ jobs:
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
 
+      - name: Download SBOM
+        uses: actions/download-artifact@v4
+        with:
+          name: sbom
+
       - name: Update Github release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release upload --repo vacanza/python-holidays ${{ github.ref_name }} dist/*
+          gh release upload --repo vacanza/python-holidays ${{ github.ref_name }} holidays-*-sbom.json

.gitignore

@@ -20,4 +20,5 @@ holidays/locale/pot/*.pot
 !holidays/locale/pot/UA.pot
 MANIFEST
 Pipfile
+sbom.json
 venv/

Makefile

@@ -43,6 +43,9 @@ package:
 pre-commit:
 	pre-commit run --all-files
 
+sbom:
+	@python -m cyclonedx_py requirements requirements/runtime.txt
+
 setup:
 	pip install --upgrade pip
 	pip install --requirement requirements/dev.txt

requirements/build.txt

@@ -1,2 +1,3 @@
 build==1.2.1
+cyclonedx-bom==4.5.0
 polib==1.2.0