[pdelsante]

Goal

Add the composite action actions/dependency_track (CycloneDX SBOM of a directory with syft, uploaded to Dependency-Track) and an optional dependency_track_project_name input on _release_and_tag.yml that uploads the SBOM of the released wheel.

Why

Libraries and Lambda projects have no CodeBuild, so the code_pipeline/build SBOM upload never runs for them (certego/dependencytrack#8).

How

1. actions/dependency_track/action.yml: same syft image/digest, file-metadata setting and root-linking jq as code_pipeline/build 1.2.1; dir: scan; inputs via env:; never fails the job (::warning::).
2. _release_and_tag.yml: new input; the build steps also run when it is set; the wheel is installed with pip install --target (continue-on-error) and scanned; version = release tag, isLatest true.
3. .github/workflows/_release_and_tag.yml re-linked to the root copy (it had drifted, hence the larger diff); new action hard-linked under .github/actions/.
4. README + CHANGELOG (2.1.0).

Verified locally on the pypanoptikon 6.5.0 wheel: 16 components, root linked to pypanoptikon, upload form fields correct against a stub; unreachable URL and missing directory only warn.

Out of scope

• The pre-existing actionlint findings on the "Check Tag" step (untrusted PR title in inline script).
• Non-Python projects: generic dir: scan, unverified.

🤖 Generated with Claude Code

[pdelsante]

Branch reviewed before push (no blocking findings; fixed: Lambda SBOM now uploaded only after a successful deploy, docs snippet tolerant of push triggers). All CI checks green. Merge order: certego/dependencytrack#8 then apply configuration from the VPN (creates the org secret), then the others in any order — until the secret exists the upload only warns.