Merge branch 'generate-sbom' into version-flag-msi

Author: spoorcc

.github/workflows/build.yml

@@ -93,7 +93,7 @@ jobs:
               build/dfetch-package/*.rpm
               build/dfetch-package/*.pkg
               build/dfetch-package/*.msi
-              *.cdx.json
+              build/dfetch-package/*.cdx.json
 
   test-binary:
     name: test binary

script/create_sbom.py

@@ -13,7 +13,12 @@
 logging.basicConfig(level=logging.INFO)
 
 PROJECT_DIR = Path(__file__).parent.parent.resolve()
-OUTPUT_FILE = PROJECT_DIR / f"dfetch-{__version__}.{sys.platform}.cdx.json"
+OUTPUT_FILE = (
+    PROJECT_DIR
+    / "build"
+    / "dfetch-package"
+    / f"dfetch-{__version__}.{sys.platform}.cdx.json"
+)
 
 DEPS = f"{PROJECT_DIR}[sbom]"
 
@@ -35,6 +40,7 @@ def temporary_venv():
 
 
 with temporary_venv() as python:
+    OUTPUT_FILE.parent.mkdir(parents=True, exist_ok=True)
     subprocess.check_call([python, "-m", "pip", "install", DEPS])  # nosec
     subprocess.check_call(  # nosec
         [python, "-m", "cyclonedx_py", "environment", "-o", str(OUTPUT_FILE)]