From 509a543d4a66b0caa5001a6dcc69729e7637f38c Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 30 Sep 2025 09:30:22 +0200
Subject: [PATCH] only generate sbom for full releases

---
 .github/workflows/sbom-regenerate.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sbom-regenerate.yml b/.github/workflows/sbom-regenerate.yml
index d6a1bbe1..3e2015c1 100644
--- a/.github/workflows/sbom-regenerate.yml
+++ b/.github/workflows/sbom-regenerate.yml
@@ -17,7 +17,9 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           RELEASES_JSON=$(gh api repos/${{ github.repository }}/releases \
-            --jq '[.[] | select(.draft == false) | {tagName: .tag_name, uploadUrl: .upload_url}][:1]')
+            --jq '[.[]
+                   | select(.draft == false and (.tag_name | test("^v[0-9]+\\.[0-9]+\\.[0-9]+$")))
+                   | {tagName: .tag_name, uploadUrl: .upload_url}][:1]')
           echo "releases=$RELEASES_JSON" >> $GITHUB_OUTPUT
 
   regenerate-for-release: