From 2fb782495102a01ac535fd255fd57447d2cf952b Mon Sep 17 00:00:00 2001 From: Arthit Suriyawongkul Date: Tue, 11 Aug 2026 15:13:04 +0100 Subject: [PATCH 1/4] Add Pitloom to generate package SBOM in wheel Add "pitllom" to Hatchling build hook to get SBOM and put it in the wheel. Signed-off-by: Arthit Suriyawongkul --- pyproject.toml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index cf3110f1..51bb7e6e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -55,7 +55,7 @@ Issues = "https://github.com/JPEWdev/shacl2code/issues" shacl2code = "shacl2code:main" [build-system] -requires = ["hatchling"] +requires = ["hatchling>=1.28.0", "pitloom>=0.13.3"] build-backend = "hatchling.build" [tool.hatch.version] @@ -77,6 +77,11 @@ warn_redundant_casts = true # warn_unreachable = true # warn_unused_ignores = true +[[tool.pitloom.creator]] +name = "Joshua Watt" +email = "JPEWhacker@gmail.com" +type = "person" + [tool.pytest.ini_options] addopts = [ "--import-mode=importlib", From 8d5ca6ad9ac5b82f645ff30f1bde57302cbdee5d Mon Sep 17 00:00:00 2001 From: Arthit Suriyawongkul Date: Tue, 11 Aug 2026 15:46:29 +0100 Subject: [PATCH 2/4] Update hatchling version requirement to 1.29.0 Signed-off-by: Arthit Suriyawongkul --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 51bb7e6e..e8ad61bf 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -55,7 +55,7 @@ Issues = "https://github.com/JPEWdev/shacl2code/issues" shacl2code = "shacl2code:main" [build-system] -requires = ["hatchling>=1.28.0", "pitloom>=0.13.3"] +requires = ["hatchling>=1.29.0", "pitloom>=0.13.3"] build-backend = "hatchling.build" [tool.hatch.version] From 49e3673e25067205c3dcb4d4d5f1bbc90bbd8ce9 Mon Sep 17 00:00:00 2001 From: Arthit Suriyawongkul Date: Sat, 15 Aug 2026 23:13:54 +0100 Subject: [PATCH 3/4] Use Pitloom GitHub Action instead of Hatchling hook Signed-off-by: Arthit Suriyawongkul --- .github/workflows/publish.yaml | 6 ++++++ pyproject.toml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index ebb99f1f..ece47853 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -33,5 +33,11 @@ jobs: - name: Build package run: python -m build + - name: Generate SBOM and embed to wheel + uses: bact/pitloom@b6414eb80037ccae70eadf94ad13e3bc1063b114 # v0.15.0 + with: + embed-wheel: "dist/*.whl" + extras: "content-type" + - name: Publish distribution to PyPI uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1 diff --git a/pyproject.toml b/pyproject.toml index 7d00e0a1..a71f869d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -56,7 +56,7 @@ Issues = "https://github.com/JPEWdev/shacl2code/issues" shacl2code = "shacl2code:main" [build-system] -requires = ["hatchling>=1.29.0", "pitloom>=0.13.3"] +requires = ["hatchling"] build-backend = "hatchling.build" [tool.hatch.version] From 0f2868609bee349896c8a91fcbfecb112a7aebad Mon Sep 17 00:00:00 2001 From: Arthit Suriyawongkul Date: Sat, 15 Aug 2026 23:16:32 +0100 Subject: [PATCH 4/4] Enable content-type scan Signed-off-by: Arthit Suriyawongkul --- .github/workflows/publish.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index ece47853..8afbdd51 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -33,11 +33,12 @@ jobs: - name: Build package run: python -m build - - name: Generate SBOM and embed to wheel + - name: Generate SBOM uses: bact/pitloom@b6414eb80037ccae70eadf94ad13e3bc1063b114 # v0.15.0 with: embed-wheel: "dist/*.whl" extras: "content-type" + content-type: "true" - name: Publish distribution to PyPI uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1