Release of 0.4.0?

[matmannion]

We're currently setting up Dependency-Track for our projects and it'd be good to get the updates already in the repository published, we'd like to use CycloneDX 1.5/1.6 to verify if it gets the dependency graph working

[raboof]

I think that would be a good idea. I'd like to see #92 merged before we do. After that I can find some time to do the release (which will probably take some effort as this will be the first time releasing from org.github.sbt).

[raboof]

to verify if it gets the dependency graph working

I suspect the dependency graph depends on the "dependencies" section of the SBOM being populated, which we don't do yet. Filed #108 for that feature.

[raboof]

After that I can find some time to do the release (which will probably take some effort as this will be the first time releasing from org.github.sbt).

I think we're ready to perform this release.

@eed3si9n should I be able to 'just' add the tag and let https://github.com/sbt/sbt-sbom/blob/main/.github/workflows/ci.yml#L99 take care of things, or do you have to make preparations setting up secrets?

[raboof]

Seems to work great! apache/pekko#1712

Also added scala-steward-org/scala-steward#3544

[eed3si9n]

Tagging should just work since I guess I've already put in the credential etc a while back.
https://github.com/sbt/sbt-sbom/actions/runs/12771229717/job/35598422263

[raboof]

yes looks like it!

[eed3si9n]

I've written up a release note for this. Feel free to edit it since you have more context around the changes - https://github.com/sbt/sbt-sbom/releases/tag/v0.4.0