From 86087d8fb8f58f5551b09e5fcd70e55110301373 Mon Sep 17 00:00:00 2001
From: Lukas Puehringer <lukas.puehringer@eclipse-foundation.org>
Date: Tue, 15 Sep 2026 12:50:30 +0200
Subject: [PATCH] Authenticate SBOM uploads with PIA

Replace the `actions/upload-artifact` step and deprecated `store-sbom-data`
reusable-workflow job with the `upload-sbom` composite action, which
uploads the SBOM to DependencyTrack (sbom.eclipse.org) via PIA.

PIA authenticates the upload with OIDC, hence the added `id-token: write`
permission, and resolves the DependencyTrack project from
product-name/product-version, so the hard-coded parent project UUID is no
longer needed.

More at https://eclipse-csi.github.io/security-handbook/sbom/howto.html#how-to-upload-an-sbom-to-dependencytrack

Assisted-by: Claude:claude-opus-5
Signed-off-by: Lukas Puehringer <lukas.puehringer@eclipse-foundation.org>
---
 .github/workflows/generate-python-sbom.yml | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/generate-python-sbom.yml b/.github/workflows/generate-python-sbom.yml
index ca74914..11509a8 100644
--- a/.github/workflows/generate-python-sbom.yml
+++ b/.github/workflows/generate-python-sbom.yml
@@ -27,8 +27,9 @@ permissions:
 jobs:
   generate-sbom:
     runs-on: ubuntu-latest
-    outputs:
-      project-version: ${{ steps.version.outputs.PROJECT_VERSION }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -63,17 +64,8 @@ jobs:
         run: cyclonedx-py requirements ${{ env.PRODUCT_PATH }}/requirements.txt -o bom.json
 
       - name: Upload sbom
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: eclipse-csi/workflows/upload-sbom@20e3c63807b2bd61b7f1a9f438e5ce588c054efc # main
         with:
-          name: sbom
-          path: bom.json
-
-  store-sbom-data: # stores sbom and metadata in a predefined format for otterdog to pick up
-    needs: ['generate-sbom']
-    uses: eclipse-csi/workflows/.github/workflows/store-sbom-data.yml@main
-    with:
-      projectName: 'kuksa-python-sdk'
-      projectVersion: ${{ needs.generate-sbom.outputs.project-version }}
-      bomArtifact: 'sbom'
-      bomFilename: 'bom.json'
-      parentProject: 'ec1518ae-819b-41fa-a266-b94c3212aaef'
+          sbom-file: bom.json
+          product-name: 'kuksa-python-sdk'
+          product-version: ${{ steps.version.outputs.PROJECT_VERSION }}