chore: update SBOM for Python 3.11 (#4230) #106

	name: Build pip wheel

	permissions: read-all

	on:
	push:
	branches: [ "main" ]
	workflow_dispatch:

	jobs:
	build:
	name: Build wheel
	runs-on: ubuntu-latest
	permissions:
	id-token: write
	attestations: write
	contents: read
	strategy:
	fail-fast: false
	matrix:
	python-version:
	- "3.12"
	if: github.repository == 'intel/cve-bin-tool' # run on origin repo only
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
	with:
	egress-policy: audit

	- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
	- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
	with:
	python-version: ${{ matrix.python-version }}
	cache: 'pip'
	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip setuptools wheel build
	- name: Build
	run: \|
	python -m build .
	- name: Get built filenames
	id: filename
	run: \|
	echo "tar=$(cd dist/ && echo *.tar.gz)" >> $GITHUB_OUTPUT
	echo "whl=$(cd dist/ && echo *.tar.gz)" >> $GITHUB_OUTPUT
	- name: Attest Build Provenance for tar
	uses: actions/attest-build-provenance@bdd51370e0416ac948727f861e03c2f05d32d78e # v1.3.2
	with:
	subject-path: "dist/${{ steps.filename.outputs.tar }}"
	- name: Attest Build Provenance for whl
	uses: actions/attest-build-provenance@bdd51370e0416ac948727f861e03c2f05d32d78e # v1.3.2
	with:
	subject-path: "dist/${{ steps.filename.outputs.whl }}"
	# TODO Upload to pypi on release creation

Provide feedback