CI:

.gitea/workflows/ci.yaml

@@ -81,13 +81,31 @@ jobs:
           echo "SBOM components: $(python3 -c 'import json; print(len(json.load(open("sbom.cdx.json")).get("components",[])))' 2>/dev/null || echo n/a)"
           ls -l sbom.cdx.json
 
-      - name: Upload SBOM artifact
+      # Gitea's Actions artifact backend rejects the upload-artifact@v4 protocol
+      # (GHESNotSupportedError), so publish the SBOM to the Gitea generic package
+      # registry instead — a real, versioned, downloadable artifact retrievable
+      # at /api/packages/lab/generic/sampleapp-sbom/<sha>/sbom.cdx.json. Also
+      # echo a one-line digest into the job log as a always-available fallback.
+      - name: Publish SBOM to Gitea package registry
         if: always()
-        uses: https://gitea.com/actions/upload-artifact@v4
-        with:
-          name: sbom-cyclonedx-${{ github.sha }}
-          path: sbom.cdx.json
-          if-no-files-found: warn
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -e
+          if [ ! -s sbom.cdx.json ]; then
+            echo "no sbom.cdx.json produced — skipping upload"
+            exit 0
+          fi
+          echo "SBOM sha256: $(sha256sum sbom.cdx.json | awk '{print $1}')  bytes: $(wc -c < sbom.cdx.json)"
+          code="$(curl -sS -o /tmp/sbom_up.txt -w '%{http_code}' \
+            -u "${REGISTRY_USER}:${REGISTRY_TOKEN}" \
+            -X PUT \
+            --upload-file sbom.cdx.json \
+            "https://gitea.tests01.helity.org/api/packages/lab/generic/sampleapp-sbom/${GITHUB_SHA}/sbom.cdx.json")"
+          echo "package registry upload HTTP ${code}"
+          # 201 created / 200 exists — 409 (already uploaded for this sha) is fine
+          case "$code" in 200|201|409) echo "SBOM published for ${GITHUB_SHA}";; *) cat /tmp/sbom_up.txt; exit 1;; esac
 
       # --- Push (main only) ---------------------------------------------------
       - name: Push image (main only)