From 035755f13fca1826b728002f392e9ec068e9ee80 Mon Sep 17 00:00:00 2001
From: Cyrille Nofficial <cynoffic@cyrilix.fr>
Date: Wed, 14 Oct 2026 19:12:08 +0200
Subject: [PATCH] ci: upload the SBOM to DependencyTrack for releases only

Manual test builds (test-<sha>) left throwaway project versions in
DependencyTrack; the SBOM is still generated (log shows the component count).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/build.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 0c3462b..df5d395 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -101,7 +101,10 @@ jobs:
           syft "registry:$IMAGE:${{ steps.meta.outputs.tag }}" --platform linux/amd64 -o cyclonedx-json=sbom.cdx.json
           echo "components: $(grep -o '"bom-ref"' sbom.cdx.json | wc -l)"
 
+      # Releases only: manual test builds (test-<sha>) would otherwise leave throwaway project
+      # versions in DependencyTrack.
       - name: upload SBOM to DependencyTrack
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           DT_API_KEY: ${{ secrets.DT_API_KEY }}
         run: |