chore: trusted publishing (#682)

fixes #681 --------- Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> Signed-off-by: semantic-release <semantic-release@bot.local> Co-authored-by: semantic-release <semantic-release@bot.local>
CycloneDX · Sep 23, 2024 · 96386cc · 96386cc
1 parent 39514b3
commit 96386cc
Show file tree

Hide file tree

Showing 5 changed files with 118 additions and 4 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -120,7 +120,7 @@ jobs:
         # see https://github.com/pypa/gh-action-pypi-publish
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
+          attestations: true
 
       - name: Publish package distributions to GitHub Releases
         if: steps.release.outputs.released == 'true'

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,8 +2,98 @@
 
 
 
+## v8.0.0-alpha.1 (2024-09-23)
+
+### Chore
+
+* chore: trusted publishing
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`ce23b0f`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/ce23b0f73f65a868b74de47a50d1e383a6f705d6))
+
+### Fix
+
+* fix: assert copyright headers
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`bef268b`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/bef268b7abe2c3f343274d7789906c99c80e9df9))
+
+### Unknown
+
+* Merge branch &#39;main&#39; into 8.0.0-dev
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`39514b3`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/39514b331eef98fbf5208ead341060831f8acddf))
+
+* Merge branch &#39;main&#39; into 8.0.0-dev ([`c123aff`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/c123aff4bd479ec0f5f1982725ffe8901afb87c9))
+
+
 ## v7.6.1 (2024-09-18)
 
+### Breaking
+
+* feat!: this-builder (#649)
+
+reworked `ThisTool` for #635
+
+---------
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`cf5d2c7`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/cf5d2c7e43883967c5d5837f465ecac5a8cc034e))
+
+* refactor!: `LicenseExpression()` optional args are named args (#595)
+
+fixes #594
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`0172564`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/0172564d5f9529e7ce543da434969b552833de31))
+
+* feat!: Add component and services for tools (#635)
+
+CycloneDX spec 1.5 deprecated an array of tools in bom.metadata and
+instead prefers object with an array of components and an array of
+services.
+
+This PR implements that.
+
+This works de-serializing a Syft SBOM with a tool section like so:
+```
+  &#34;metadata&#34;: {
+    &#34;timestamp&#34;: &#34;2024-06-10T13:06:52-08:00&#34;,
+    &#34;tools&#34;: {
+      &#34;components&#34;: [
+        {
+          &#34;type&#34;: &#34;application&#34;,
+          &#34;author&#34;: &#34;anchore&#34;,
+          &#34;name&#34;: &#34;syft&#34;,
+          &#34;version&#34;: &#34;1.4.1&#34;
+        }
+      ]
+    },
+    &#34;component&#34;: {
+      &#34;bom-ref&#34;: &#34;08329a07b4eb8eac&#34;,
+      &#34;type&#34;: &#34;file&#34;,
+      &#34;name&#34;: &#34;./&#34;
+    }
+  },
+```
+Next up: docs, XML (de)serialization code, and tests.
+
+fixes #561
+
+---------
+
+Signed-off-by: Joshua Kugler &lt;tek30584@adobe.com&gt;
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt;
+Co-authored-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`1f5fd7a`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/1f5fd7a6be94d93d2260622d39ea01cd74614402))
+
+* feat!: 8.0.0
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`9ba4b8e`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/9ba4b8e5d255c8dba51df214786328bfa700291c))
+
+### Feature
+
+* feat: don&#39;t add self to `metafata.tools` (#674)
+
+fixes #673
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`e0a153f`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/e0a153fbd553dcf29343d72e361c1cc9122c63b4))
+
 ### Fix
 
 * fix: file copyright headers (#676)
@@ -14,6 +104,30 @@ correct headers
 
 Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`35e00b4`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/35e00b4ee5a9306b9e97b011025409bcbfcef309))
 
+### Refactor
+
+* refactor: simplify `.builder.this.this_tool`
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`9940cf9`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/9940cf95e619d67a2a15ff7e6784513059e6ab5e))
+
+### Unknown
+
+* Merge branch &#39;main&#39; into 8.0.0-dev ([`3d1548a`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/3d1548abf5db45764a22fcca96493574f96ff693))
+
+* Merge branch &#39;main&#39; into 8.0.0-dev
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`735c800`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/735c8003ce88b0c6efa802ccd806f17d22b4df89))
+
+* tests: test builder this (#675)
+
+QA for https://github.com/CycloneDX/cyclonedx-python-lib/pull/649
+
+---------
+
+Signed-off-by: Jan Kowalleck &lt;jan.kowalleck@gmail.com&gt; ([`e4ad3bc`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/e4ad3bce1f97f77d7c3468765e47dd15929cbbcd))
+
+* Merge branch &#39;main&#39; into 8.0.0-dev ([`0ec785d`](https://github.com/CycloneDX/cyclonedx-python-lib/commit/0ec785d29abcc215a5a0f6feec9bf16b0994cc92))
+
 
 ## v7.6.0 (2024-08-14)
 

diff --git a/cyclonedx/__init__.py b/cyclonedx/__init__.py
@@ -22,4 +22,4 @@
 
 # !! version is managed by semantic_release
 # do not use typing here, or else `semantic_release` might have issues finding the variable
-__version__ = "7.6.1"  # noqa:Q000
+__version__ = "8.0.0-alpha.1"  # noqa:Q000
diff --git a/docs/conf.py b/docs/conf.py
@@ -20,7 +20,7 @@
 
 # The full version, including alpha/beta/rc tags
 # !! version is managed by semantic_release
-release = '7.6.1'
+release = '8.0.0-alpha.1'
 
 # -- General configuration ---------------------------------------------------
 

diff --git a/pyproject.toml b/pyproject.toml
@@ -5,7 +5,7 @@ build-backend = "poetry.core.masonry.api"
 [tool.poetry]
 name = "cyclonedx-python-lib"
 # !! version is managed by semantic_release
-version = "7.6.1"
+version = "8.0.0-alpha.1"
 description = "Python library for CycloneDX"
 authors = [
   "Paul Horton <phorton@sonatype.com>",