Ukraine has (had) some 15 reactors on line at the start of hostilities, and mined and processed about 30% of the fuel for those reactors.
Between highly radioactive materials left lying about poorly (or un-) reclaimed mine sites, and spent fuel, they would have ample material for 'dirty bombs'.
As for building their own fission devices, I would not sell them short, even though there is no present indication they have done so.