Move SBOM file out of dist/ before PyPI upload

[Copilot]

PyPI rejects sbom.json with InvalidDistribution: Unknown distribution format. The SBOM file was being generated in dist/ and included in the PyPI upload, but PyPI only accepts .whl and .tar.gz files.

Changes

• Move sbom.json to attestations/ directory before PyPI publish step (alongside existing Sigstore attestation files)
• Update GitHub release upload to reference attestations/sbom.json instead of dist/sbom.json

- name: Move Sigstore attestations and SBOM out of dist
  run: |
    mkdir -p attestations
    if ls dist/*.sigstore.json 1> /dev/null 2>&1; then
      mv dist/*.sigstore.json attestations/
    fi
    if [ -f dist/sbom.json ]; then
      mv dist/sbom.json attestations/
    fi

Result: Only .whl and .tar.gz files remain in dist/ for PyPI upload. SBOM still included in GitHub releases.

Original prompt

#161 was incomplete, see the last error:
Status: Downloaded newer image for ghcr.io/pypa/gh-action-pypi-publish:v1.13.0
Checking dist/gsppy-3.2.6-py3-none-any.whl: PASSED
Checking dist/gsppy-3.2.6.tar.gz: PASSED
Checking dist/sbom.json: ERROR InvalidDistribution: Unknown distribution format: 'sbom.json'

Fix to guarantee only the right files are uploaded

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes a PyPI upload failure by ensuring only .whl and .tar.gz files remain in the dist/ directory. PyPI was rejecting sbom.json with an InvalidDistribution: Unknown distribution format error. The fix moves the SBOM file to an attestations/ directory before the PyPI publish step, mirroring the existing approach for Sigstore attestation files.

Key changes:

• Move sbom.json from dist/ to attestations/ directory before PyPI upload
• Update GitHub release asset path to reference attestations/sbom.json

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.