Add project name and version context to SBOM file name

exasol/toolbox/nox/_dependencies.py

@@ -21,6 +21,9 @@
 from exasol.toolbox.util.dependencies.poetry_dependencies import get_dependencies
 from exasol.toolbox.util.dependencies.track_vulnerabilities import DependenciesAudit
 from exasol.toolbox.util.dependencies.update_dependencies import DependencyUpdater
+from exasol.toolbox.util.version import (
+    project_name_and_version_from_poetry,
+)
 from noxconfig import PROJECT_CONFIG
 
 
@@ -109,8 +112,12 @@ def generate_sbom(session: Session) -> None:
     Note: SPDX version 2 is used as no stable Python tool exists yet
     for generating SPDX version 3.
     """
+    project_name, version = project_name_and_version_from_poetry(
+        working_directory=PROJECT_CONFIG.root_path
+    )
+    sbom_filename = f"{project_name}-{version}.spdx.json"
     bom_cdx_json = PROJECT_CONFIG.root_path / "bom.cdx.json"
-    bom_spdx_json = PROJECT_CONFIG.root_path / "bom.spdx.json"
+    bom_spdx_json = PROJECT_CONFIG.root_path / sbom_filename
     session.run("cyclonedx-py", "environment", "-o", bom_cdx_json)
     session.run(
         "sbomconvert",
@@ -124,3 +131,4 @@ def generate_sbom(session: Session) -> None:
         bom_spdx_json,
     )
     session.run("test", "-s", bom_spdx_json)
+    print(sbom_filename)

exasol/toolbox/templates/github/workflows/build-and-publish.yml

@@ -33,8 +33,9 @@ jobs:
 
       - name: Generate SBOM
         id: generate-sbom
-        run: poetry run -- nox -s dependency:sbom
-
+        run: |
+          SBOM_NAME="$(poetry run -- nox -s dependency:sbom)"
+          echo "SBOM_NAME=$SBOM_NAME" >> "$GITHUB_OUTPUT"
       - name: Publish Release to PyPi
         id: publish-release-to-pypi
         env:
@@ -46,9 +47,10 @@ jobs:
         id: publish-release-to-github
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SBOM_NAME: ${{ steps.generate-sbom.outputs.SBOM_NAME }}
         run: >
           gh release create ${GITHUB_REF_NAME}
           --title ${GITHUB_REF_NAME}
           --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md
           dist/*
-          bom.spdx.json
+          "$SBOM_NAME"

exasol/toolbox/util/version.py

@@ -7,6 +7,7 @@
     total_ordering,
     wraps,
 )
+from pathlib import Path
 from shutil import which
 
 from exasol.toolbox.error import ToolboxError
@@ -104,3 +105,19 @@ def upgrade_version_from_poetry(t: ReleaseTypes):
             text=True,
         )
         return Version.from_string(output.stdout.strip())
+
+
+@poetry_command
+def project_name_and_version_from_poetry(
+    working_directory: Path | None = None,
+) -> tuple[str, Version]:
+    """Return the project name and version reported by Poetry."""
+    output = subprocess.run(  # nosec: B603, B607 - allow fixed poetry command
+        ["poetry", "version", "--no-ansi"],
+        cwd=working_directory,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    project_name, version = output.stdout.strip().rsplit(maxsplit=1)
+    return project_name.replace("-", "_"), Version.from_string(version)

test/unit/nox/_dependencies_test.py

@@ -6,6 +6,7 @@
 from exasol.toolbox.nox import _dependencies
 from exasol.toolbox.nox import _shared as nox_shared
 from exasol.toolbox.util.dependencies.audit import Vulnerabilities
+from exasol.toolbox.util.version import Version
 
 
 @pytest.mark.parametrize(
@@ -91,10 +92,18 @@ def test_report_resolved_vulnerabilities(
 def test_generate_sbom(monkeypatch, nox_session, tmp_path, test_project_config_factory):
     project_config = test_project_config_factory(root_path=tmp_path)
     monkeypatch.setattr(_dependencies, "PROJECT_CONFIG", project_config)
+    monkeypatch.setattr(
+        _dependencies,
+        "project_name_and_version_from_poetry",
+        lambda working_directory=None: (
+            "exasol_toolbox",
+            Version.from_string("10.3.0"),
+        ),
+    )
 
     _dependencies.generate_sbom(nox_session)
 
-    expected_file = tmp_path / "bom.spdx.json"
+    expected_file = tmp_path / "exasol_toolbox-10.3.0.spdx.json"
     bom_spdx_json = json.loads(expected_file.read_text())
     assert bom_spdx_json["SPDXID"] == "SPDXRef-DOCUMENT"
     assert bom_spdx_json["spdxVersion"] == "SPDX-2.3"