From 3593fde6af2cbcdc1ca243f2533bc14f427f97ff Mon Sep 17 00:00:00 2001 From: Glenn Jocher Date: Tue, 6 Oct 2026 18:34:38 +0200 Subject: [PATCH 1/5] Use setup-uv defaults for Python and the venv --- .github/workflows/publish.yml | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c04ddd3..027373f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,11 +29,8 @@ jobs: previous_tag: ${{ steps.check_pypi.outputs.previous_tag }} steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 - with: - python-version: "3.x" - uses: ultralytics/actions/setup-uv@main - - run: uv pip install --system --no-cache ultralytics-actions + - run: uv pip install --no-cache ultralytics-actions - id: check_pypi shell: python env: @@ -77,12 +74,8 @@ jobs: contents: read steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 - with: - python-version: "3.x" - uses: ultralytics/actions/setup-uv@main - - run: uv pip install --system --no-cache build - - run: python -m build + - run: uv build - uses: actions/upload-artifact@v7 with: name: dist @@ -127,20 +120,13 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 - with: - python-version: "3.x" - uses: ultralytics/actions/setup-uv@main - - run: | - uv venv sbom-env - uv pip install -e . - env: - VIRTUAL_ENV: sbom-env + - run: uv pip install -e . - uses: anchore/sbom-action@v0 with: format: spdx-json output-file: sbom.spdx.json - path: sbom-env + path: .venv - run: gh release upload ${{ needs.check.outputs.current_tag }} sbom.spdx.json --clobber env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 8af5ed06b8db78a9dbcfa6d2cc159e6ce06b0b52 Mon Sep 17 00:00:00 2001 From: Glenn Jocher Date: Tue, 6 Oct 2026 18:34:38 +0200 Subject: [PATCH 2/5] Validate against ultralytics/actions#915 setup-uv-defaults branch --- .github/workflows/publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 027373f..0245c88 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: previous_tag: ${{ steps.check_pypi.outputs.previous_tag }} steps: - uses: actions/checkout@v7 - - uses: ultralytics/actions/setup-uv@main + - uses: ultralytics/actions/setup-uv@setup-uv-defaults - run: uv pip install --no-cache ultralytics-actions - id: check_pypi shell: python @@ -74,7 +74,7 @@ jobs: contents: read steps: - uses: actions/checkout@v7 - - uses: ultralytics/actions/setup-uv@main + - uses: ultralytics/actions/setup-uv@setup-uv-defaults - run: uv build - uses: actions/upload-artifact@v7 with: @@ -120,7 +120,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: ultralytics/actions/setup-uv@main + - uses: ultralytics/actions/setup-uv@setup-uv-defaults - run: uv pip install -e . - uses: anchore/sbom-action@v0 with: From 607e5982dd1f1b2491035d7f54baf4a4ad7413fe Mon Sep 17 00:00:00 2001 From: Glenn Jocher Date: Tue, 6 Oct 2026 18:38:46 +0200 Subject: [PATCH 3/5] Scan the activated venv for the SBOM --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0245c88..de1e12d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -126,7 +126,7 @@ jobs: with: format: spdx-json output-file: sbom.spdx.json - path: .venv + path: ${{ env.VIRTUAL_ENV }} - run: gh release upload ${{ needs.check.outputs.current_tag }} sbom.spdx.json --clobber env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From fba1b641126e64eb1ed3278d37bf62f582ceb84e Mon Sep 17 00:00:00 2001 From: Glenn Jocher Date: Tue, 6 Oct 2026 18:59:57 +0200 Subject: [PATCH 4/5] Name the SBOM after the repository --- .github/workflows/publish.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index de1e12d..494b364 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -127,6 +127,8 @@ jobs: format: spdx-json output-file: sbom.spdx.json path: ${{ env.VIRTUAL_ENV }} + env: + SYFT_SOURCE_NAME: ${{ github.repository }} # name the SBOM after the repo, not the venv path - run: gh release upload ${{ needs.check.outputs.current_tag }} sbom.spdx.json --clobber env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From c3144e86c1b6ca9b67b50ce1cddfbea4539938b2 Mon Sep 17 00:00:00 2001 From: Glenn Jocher Date: Tue, 6 Oct 2026 19:18:19 +0200 Subject: [PATCH 5/5] Point setup-uv back to @main now that ultralytics/actions#915 is merged --- .github/workflows/publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 494b364..68b4bb6 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ jobs: previous_tag: ${{ steps.check_pypi.outputs.previous_tag }} steps: - uses: actions/checkout@v7 - - uses: ultralytics/actions/setup-uv@setup-uv-defaults + - uses: ultralytics/actions/setup-uv@main - run: uv pip install --no-cache ultralytics-actions - id: check_pypi shell: python @@ -74,7 +74,7 @@ jobs: contents: read steps: - uses: actions/checkout@v7 - - uses: ultralytics/actions/setup-uv@setup-uv-defaults + - uses: ultralytics/actions/setup-uv@main - run: uv build - uses: actions/upload-artifact@v7 with: @@ -120,7 +120,7 @@ jobs: contents: write steps: - uses: actions/checkout@v7 - - uses: ultralytics/actions/setup-uv@setup-uv-defaults + - uses: ultralytics/actions/setup-uv@main - run: uv pip install -e . - uses: anchore/sbom-action@v0 with: