feat: bump cyclonedx-python-lib to latest RC of 4.0.x

.github/workflows/docker.yml

@@ -3,16 +3,16 @@
 
 name: Docker CI
 
-on: 
+on:
   push:
-    branches: ["master"]
+    branches: ["main"]
   pull_request:
   workflow_dispatch:
 
 env:
   REPORTS_DIR: CI_reports
-  PYTHON_VERISON: "3.10"
-  POETRY_VERSION: "1.1.15"
+  PYTHON_VERSION: "3.11"
+  POETRY_VERSION: "1.4.0"
 
 jobs:
   test:
@@ -28,26 +28,33 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
+
       - name: setup reports-dir
         run: mkdir "$REPORTS_DIR"
-      - name: Setup python ${{ env.PYTHON_VERISON }}
+
+      - name: Setup python ${{ env.PYTHON_VERSION }}
         # see https://github.com/actions/setup-python
         uses: actions/setup-python@v4
         with:
-          python-version: ${{ env.PYTHON_VERISON }}
+          python-version: ${{ env.PYTHON_VERSION }}
+          architecture: 'x64'
+
       - name: Setup poetry ${{ env.POETRY_VERSION }}
         # see https://github.com/marketplace/actions/setup-poetry
         uses: Gr1N/setup-poetry@v8
         with:
           poetry-version: ${{ env.POETRY_VERSION }}
+
       - name: bump version
         id: bump-version
         run: |
           VERSION="${{ github.run_id }}.${{ github.run_number }}.${{ github.run_attempt }}+testing"
           poetry version "$VERSION"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
+
       - name: Poetry build
         run: poetry build
+
       - name: Artifact python dist
         if: |
           !failure() && !cancelled() &&
@@ -58,6 +65,7 @@ jobs:
           name: ${{ env.RUN_ARTIFACT_PYTHON_DIST }}
           path: ${{ env.DIST_SOURCE_DIR }}/
           if-no-files-found: warn
+
       - name: Build Docker image
         env:
           VERSION: ${{ steps.bump-version.outputs.version }}
@@ -66,6 +74,7 @@ jobs:
           --build-arg "VERSION=$VERSION"
           -t "$DOCKER_TAG"
           .
+
       - name: Build own SBoM (XML)
         run: >
           docker run --rm "$DOCKER_TAG"
@@ -74,6 +83,7 @@ jobs:
           --format=xml
           --output=-
           > "$REPORTS_DIR/docker-image.bom.xml"
+
       - name: Build own SBoM (JSON)
         run: >
           docker run --rm "$DOCKER_TAG"
@@ -82,6 +92,7 @@ jobs:
           --format=json
           --output=-
           > "$REPORTS_DIR/docker-image.bom.json"
+
       - name: Artifact reports
         if: ${{ ! cancelled() }}
         # see https://github.com/actions/upload-artifact
@@ -90,6 +101,7 @@ jobs:
           name: ${{ env.REPORTS_ARTIFACT }}
           path: ${{ env.REPORTS_DIR }}
           if-no-files-found: error
+
       - name: Destroy Docker image
         # run regardless of outcome
         if: ${{ always() }}

.github/workflows/manual-release-candidate.yml

@@ -2,18 +2,13 @@ name: Manual Pre Release Publish
 
 on:
   workflow_dispatch:
-    inputs:
-      release_candidate_suffix:
-        description: 'RC Suffix e.g. rc0, beta1, alpha2. Do not include a leading hyphen.'
-        required: true
-        type: string
 
 env:
   REPORTS_DIR: CI_reports
   DIST_DIR: dist
   DIST_ARTIFACT: python-dist
-  PYTHON_VERISON: "3.10"
-  POETRY_VERSION: "1.1.15"
+  PYTHON_VERSION: "3.11"
+  POETRY_VERSION: "1.4.0"
 
 jobs:
   release_candidate:
@@ -24,30 +19,33 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
+
       - uses: actions/setup-python@v4
         with:
-          python-version: ${{ env.PYTHON_VERISON }}
+          python-version: ${{ env.PYTHON_VERSION }}
+          architecture: 'x64'
+
+      - name: Install poetry
+        # see https://github.com/marketplace/actions/setup-poetry
+        uses: Gr1N/setup-poetry@v8
+        with:
+          poetry-version: ${{ env.POETRY_VERSION }}
+
       - name: Install dependencies
         run: |
           python -m pip install poetry=="$POETRY_VERSION" --upgrade pip
           poetry config virtualenvs.create false
           poetry install
-          python -m pip install packaging python-semantic-release
-      - name: Apply Pre Release Version
-        run: |
-          RC_VERSION="$(semantic-release --noop --major print-version)-${{ github.event.inputs.release_candidate_suffix }}"
-          echo "RC Version will be: ${RC_VERSION}"
-          poetry version ${RC_VERSION}
-          poetry build
-      - name: Artifact python dist
-        # see https://github.com/actions/upload-artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: ${{ env.DIST_ARTIFACT }}
-          path: ${{ env.DIST_DIR }}/
-          if-no-files-found: error
-      - name: Publish Pre Release 📦 to PyPI
-        # see https://github.com/pypa/gh-action-pypi-publish
-        uses: pypa/gh-action-pypi-publish@master
-        with:
-          password: ${{ secrets.PYPI_TOKEN }}
+
+      - name: Install dependencies
+        run: poetry install --no-root
+
+      - name: View poetry version
+        run: poetry --version
+
+      - name: Perform Release 📦
+        run: semantic-release publish --prerelease
+        env:
+          GH_TOKEN:            ${{ secrets.GH_TOKEN }}
+          REPOSITORY_USERNAME: __token__
+          REPOSITORY_PASSWORD: ${{ secrets.PYPI_TOKEN }}

.github/workflows/python.yml

@@ -25,12 +25,12 @@ on:
     branches-ignore: ['dependabot/**']
   push:
     tags: [ 'v*.*.*' ]  # run again on release tags to have tools mark them
-    branches: [ 'master' ]
+    branches: [ 'main' ]
 
 env:
   REPORTS_DIR: CI_reports
-  PYTHON_VERISON_DEFAULT: "3.11"
-  POETRY_VERSION: "1.1.15"
+  PYTHON_VERSION_DEFAULT: "3.11"
+  POETRY_VERSION: "1.4.0"
 
 jobs:
   coding-standards:
@@ -41,19 +41,23 @@ jobs:
       - name: Checkout
         # see https://github.com/actions/checkout
         uses: actions/checkout@v3
+
       - name: Setup Python Environment
         # see https://github.com/actions/setup-python
         uses: actions/setup-python@v4
         with:
-          python-version: ${{ env.PYTHON_VERISON_DEFAULT }}
+          python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
           architecture: 'x64'
+
       - name: Install poetry
         # see https://github.com/marketplace/actions/setup-poetry
         uses: Gr1N/setup-poetry@v8
         with:
           poetry-version: ${{ env.POETRY_VERSION }}
+
       - name: Install dependencies
-        run: poetry install
+        run: poetry install --no-root
+
       - name: Run tox
         run: poetry run tox -e flake8 -s false
 
@@ -70,26 +74,30 @@ jobs:
             toxenv-factor: 'locked'
             os: ubuntu-latest
           - # test with the lowest dependencies
-            python-version: '3.6'
+            python-version: '3.7'
             toxenv-factor: 'lowest'
             os: ubuntu-20.04
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
         uses: actions/checkout@v3
+
       - name: Setup Python Environment
         # see https://github.com/actions/setup-python
         uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
           architecture: 'x64'
+
       - name: Install poetry
         # see https://github.com/marketplace/actions/setup-poetry
         uses: Gr1N/setup-poetry@v8
         with:
           poetry-version: ${{ env.POETRY_VERSION }}
+
       - name: Install dependencies
-        run: poetry install
+        run: poetry install --no-root
+
       - name: Run tox
         run: poetry run tox -e mypy-${{ matrix.toxenv-factor }} -s false
 
@@ -108,53 +116,53 @@ jobs:
           - "3.10"
           - "3.9"
           - "3.8"
-          - "3.7"
-          - "3.6"  # lowest supported -- handled in include
+          - "3.7"  # lowest supported -- handled in include
         toxenv-factor: ['locked']
         include:
-          - # test with py36 ubuntu20
+          - # test with py37 ubuntu20
             os: ubuntu-20.04
-            python-version: '3.6'
+            python-version: '3.7'
             toxenv-factor: 'locked'
           - # test with the lowest dependencies
             os: ubuntu-20.04
-            python-version: '3.6'
+            python-version: '3.7'
             toxenv-factor: 'lowest'
-        exclude:
-          - # no py36 with latest ubuntu - see https://raw.githubusercontent.com/actions/python-versions/main/versions-manifest.json
-            os: ubuntu-latest
-            python-version: '3.6'
-          - # broken poetry installer - see https://github.com/CycloneDX/cyclonedx-python/actions/runs/3435061093/jobs/5727124247#step:6:15
-            os: macos-latest
-            python-version: '3.11'
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
         uses: actions/checkout@v3
+
       - name: Create reports directory
         run: mkdir ${{ env.REPORTS_DIR }}
+
       - name: Setup Python Environment
         # see https://github.com/actions/setup-python
         uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
           architecture: 'x64'
+
       - name: Install poetry
         # see https://github.com/marketplace/actions/setup-poetry
         uses: Gr1N/setup-poetry@v8
         with:
           poetry-version: ${{ env.POETRY_VERSION }}
+
       - name: Install dependencies
-        run: poetry install
+        run: poetry install --no-root
+
       - name: Ensure build successful
         run: poetry build
+
       - name: Run tox
         run: poetry run tox -e py-${{ matrix.toxenv-factor }} -s false
+
       - name: Generate coverage reports
         run: >
           poetry run coverage report &&
           poetry run coverage xml -o ${{ env.REPORTS_DIR }}/coverage-${{ matrix.os }}-${{ matrix.python-version }}-${{ matrix.toxenv-factor }}.xml &&
           poetry run coverage html -d ${{ env.REPORTS_DIR }}
+
       - name: Artifact reports
         if: ${{ ! cancelled() }}
         # see https://github.com/actions/upload-artifact