Enhance publish and release workflows for Python SDK

- Updated publish-python-sdk.yml and release-python-sdk.yml to generate requirements.txt from the lockfile for improved dependency management.
- Added version checks before publishing to PyPI to prevent overwriting existing versions.
- Included version output for installed SBOM generation tools to ensure transparency in the CI process.

Author: NiveditJain

.github/workflows/publish-python-sdk.yml

@@ -92,13 +92,17 @@ jobs:
 
       - name: Generate requirements file for SBOM
         run: |
-          uv export --format=requirements-txt --output-file=requirements.txt
-          echo "Generated requirements.txt for SBOM creation"
+          uv export --locked --format=requirements-txt --output-file=requirements.txt
+          echo "Generated requirements.txt for SBOM creation from lockfile"
 
       - name: Install SBOM generation tools
         run: |
           uv tool install cyclonedx-bom
+          echo "Installed cyclonedx-bom version:"
+          uv tool run cyclonedx-bom --version
           uv tool install pip-audit
+          echo "Installed pip-audit version:"
+          uv tool run pip-audit --version
 
       - name: Generate SBOM with CycloneDX
         run: |
@@ -113,7 +117,30 @@ jobs:
       - run: uv build
 
       - name: Publish to PyPI with provenance
-        run: uv publish --provenance
+        run: |
+          # Get the current version
+          VERSION=$(uv run python -c "
+          import sys
+          sys.path.append('.')
+          from exospherehost._version import version
+          print(version)
+          ")
+          
+          echo "Checking if exospherehost version $VERSION already exists on PyPI..."
+          
+          # Query PyPI JSON API to check if version exists
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/exospherehost/$VERSION/json")
+          
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "Version $VERSION already exists on PyPI. Skipping publish."
+            exit 0
+          elif [ "$HTTP_STATUS" = "404" ]; then
+            echo "Version $VERSION not found on PyPI. Proceeding with publish."
+            uv publish --provenance
+          else
+            echo "Unexpected HTTP status $HTTP_STATUS when checking PyPI. Proceeding with publish."
+            uv publish --provenance
+          fi
 
       - name: Upload SBOM artifacts
         uses: actions/upload-artifact@v4

.github/workflows/release-python-sdk.yml

@@ -124,8 +124,8 @@ jobs:
 
       - name: Generate requirements file for SBOM
         run: |
-          uv export --format=requirements-txt --output-file=requirements.txt
-          echo "Generated requirements.txt for SBOM creation"
+          uv export --locked --format=requirements-txt --output-file=requirements.txt
+          echo "Generated requirements.txt for SBOM creation from lockfile"
 
       - name: Install SBOM generation tools
         run: |
@@ -161,7 +161,7 @@ jobs:
           echo "You can verify this package's provenance on PyPI using:" >> sbom-summary.md
           echo '```bash' >> sbom-summary.md
           echo 'pip install sigstore' >> sbom-summary.md
-          echo 'python -m sigstore verify --bundle <bundle-file> exospherehost==${{ github.ref_name }}' >> sbom-summary.md
+          echo 'python -m sigstore verify --bundle <bundle-file> exospherehost==${{ startsWith(github.ref_name, 'v') && substring(github.ref_name, 1) || github.ref_name }}' >> sbom-summary.md
           echo '```' >> sbom-summary.md
 
       - run: uv build
@@ -189,5 +189,6 @@ jobs:
             python-sdk/sbom-cyclonedx.json
             python-sdk/sbom-cyclonedx.xml
             python-sdk/sbom-summary.md
+            python-sdk/vulnerability-report.json
           body_path: python-sdk/sbom-summary.md
           append_body: true