Update wheels.yml and generate-sbom.py

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

Author: aclark4life

.github/generate-sbom.py

@@ -110,7 +110,7 @@ def generate(version: str) -> dict:
                 ],
                 "patches": [
                     {
-                        "type": "generated",
+                        "type": "unofficial",
                         "diff": {
                             "text": {
                                 # raqm-version.h.in → raqm-version.h:
@@ -493,25 +493,43 @@ def generate(version: str) -> dict:
         "metadata": {
             "timestamp": now,
             "lifecycles": [{"phase": "build"}],
-            "tools": [
-                {
-                    "type": "application",
-                    "name": "generate-sbom.py",
-                    "vendor": "Pillow",
-                }
-            ],
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "name": "generate-sbom.py",
+          "group": "Pillow"
+        }
+      ]
+    },
             "component": metadata_component,
         },
         "components": ext_components + vendored_components + native_deps,
         "dependencies": dependencies,
     }
 
 
-if __name__ == "__main__":
+def main() -> None:
     version = get_version()
-    output = (
-        Path(sys.argv[1]) if len(sys.argv) > 1 else Path(f"pillow-{version}.cdx.json")
+
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.ArgumentDefaultsHelpFormatter
+    )
+    parser.add_argument(
+        "output",
+        nargs="?",
+        type=Path,
+        default=Path(f"pillow-{version}.cdx.json"),
+        help="output file",
     )
+    args = parser.parse_args()
+
     sbom = generate(version)
-    output.write_text(json.dumps(sbom, indent=2) + "\n", encoding="utf-8")
-    print(f"Wrote {output} (Pillow {version}, {len(sbom['components'])} components)")
+    args.output.write_text(json.dumps(sbom, indent=2) + "\n", encoding="utf-8")
+    print(
+        f"Wrote {args.output} (Pillow {version}, {len(sbom['components'])} components)"
+    )
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/wheels.yml

@@ -298,6 +298,11 @@ jobs:
       - name: Generate CycloneDX SBOM
         run: python3 .github/generate-sbom.py
 
+      - name: Validate SBOM
+        run: |
+          pip install check-jsonschema
+          check-jsonschema --schemafile "https://raw.githubusercontent.com/CycloneDX/specification/1.7/schema/bom-1.7.schema.json" *.cdx.json
+
       - name: Upload SBOM as workflow artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with: