Add SPDX SBOM generation to build-and-publish workflow

[Rimsha2535]

Fixes #882

Checklist

Note: If any of the items in the checklist are not relevant to your PR, just check the box.

For any Pull Request

Is the following correct:

• the title of the Pull Request?
• the title of the corresponding issue?
• there are no other open Pull Requests for the same update/change?
• that the issue which this Pull Request fixes ("Fixes...") is mentioned?

When Changes Were Made

Did you:

• update the changelog?
• update the cookiecutter-template?
• update the implementation?
• check coverage and add tests: unit tests and, if relevant, integration tests?
• update the User Guide & other documentation?
• resolve any failing CI criteria (incl. Sonar quality gate)?

When Preparing a Release

Have you:

• thought about version number (major, minor, patch)?
• checked Exasol packages for updates and resolved open vulnerabilities, if easily possible?

Notes

• Changelog was not updated because this is an internal workflow change.
• No tests were added as this is a workflow template change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ArBridgeman]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5991b5713

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run SBOM generation in the Poetry environment

Generated projects install their dependencies through the shared action with plain poetry install, which leaves them in Poetry's virtualenv and is only entered via poetry run later in the action. This command is executed after a plain pip install cyclonedx-bom, so cyclonedx-py environment scans the runner Python environment containing the SBOM tool instead of the project environment that was just built; releases will upload an SPDX file that omits the package/dependencies it is supposed to describe. Generate the SBOM from the Poetry environment or from the lock file instead.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep self-release workflows on an existing action ref

For this repository's own 10.0.0 release, release:trigger pushes the version tag first and only pushes the v10 major tag afterwards (exasol/toolbox/nox/_release.py lines 100-106, with create_major_version_tags=True). The CD workflow is triggered by that first tag, so this job can try to resolve exasol/python-toolbox/...@v10 before v10 exists and abort the release during the pre-check. The self-release workflows should keep using an already-existing ref (or the local action) until after the major tag is available.

Useful? React with 👍 / 👎.