Keep sbom together with package

Author: spoorcc

.github/workflows/build.yml

@@ -93,7 +93,7 @@ jobs:
               build/dfetch-package/*.rpm
               build/dfetch-package/*.pkg
               build/dfetch-package/*.msi
-              *.cdx.json
+              build/dfetch-package/*.cdx.json
 
   test-binary:
     name: test binary

script/create_sbom.py

@@ -13,7 +13,12 @@
 logging.basicConfig(level=logging.INFO)
 
 PROJECT_DIR = Path(__file__).parent.parent.resolve()
-OUTPUT_FILE = PROJECT_DIR / f"dfetch-{__version__}.{sys.platform}.cdx.json"
+OUTPUT_FILE = (
+    PROJECT_DIR
+    / "build"
+    / "dfetch-package"
+    / f"dfetch-{__version__}.{sys.platform}.cdx.json"
+)
 
 DEPS = f"{PROJECT_DIR}[sbom]"