From 9339b6de11ce946f35398286ed53b7286a1d963c Mon Sep 17 00:00:00 2001
From: Yash Pankhania <nevoodoo@users.noreply.github.com>
Date: Mon, 27 Apr 2026 13:10:29 +1000
Subject: [PATCH] use pyproject.toml for sbom version

---
 .github/workflows/sbom.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 020c0a9..ecd6295 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -26,6 +26,12 @@ jobs:
               -o sbom.cdx.json \
               .venv/bin/python
 
+      - name: Read project version from pyproject.toml
+        id: project_version
+        run: |
+          VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
       - name: Authenticate to GCP
         id: auth
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093  #v3.0.0
@@ -40,7 +46,7 @@ jobs:
         env:
           TOKEN: ${{ steps.auth.outputs.id_token }}
           PROJECT_NAME: ${{ github.event.repository.name }}
-          PROJECT_VERSION: ${{ github.sha }}
+          PROJECT_VERSION: ${{ steps.project_version.outputs.version }}
         run: |
             curl -sf -X POST "https://dtrack.popgen.rocks/api/v1/bom" \
               -H "Authorization: Bearer $TOKEN" \