fix(ci): remove CLI SBOM generation, reset failed v0.3.7#595
Conversation
This reverts commit 139dfc1.
Syft cannot scan Go binary archives (.tar.gz/.zip) -- it tries to interpret them as container images and fails. Since CLI binaries are statically linked with CGO_ENABLED=0, there are no runtime deps to catalog. Docker image SBOMs (generated by the Docker workflow via syft on actual container images) remain unchanged. Removed: - GoReleaser sboms stanza in .goreleaser.yml - CLI SBOM upload in cli.yml release step - CLI_SBOM_DATA HTML comment in cli.yml release notes - CLI SBOM extraction in finalize-release.yml - CLI SBOM references in CLAUDE.md Also reverts Release Please v0.3.7 commit (139dfc1). Tag and draft release deleted. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (8)
WalkthroughThis PR reverts the version number from 0.3.7 to 0.3.6 across configuration and source files, including the release manifest, project version metadata, and commitment configuration. Simultaneously, SBOM (Software Bill of Materials) generation and distribution are removed from the CLI release process by eliminating the Suggested labels
📝 Coding Plan
Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses persistent issues with the Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
🤖 I have created a release *beep* *boop* --- ## [0.3.7](v0.3.6...v0.3.7) (2026-03-19) ### Features * **engine:** implement Hybrid Plan + ReAct execution loop ([#582](#582)) ([008147c](008147c)) * implement first-run setup wizard ([#584](#584)) ([dfed931](dfed931)) ### Bug Fixes * **api:** address ZAP DAST scan findings ([#579](#579)) ([ce9a3e0](ce9a3e0)) * **ci:** remove CLI SBOM generation, reset failed v0.3.7 ([#595](#595)) ([d0f4992](d0f4992)) * **ci:** reset failed v0.3.7 release and fix syft SBOM scan ([#593](#593)) ([d1508c2](d1508c2)) * **cli:** auto-delete binary on Windows, prune images, fix GoReleaser ([#590](#590)) ([eb7c691](eb7c691)) * **cli:** regenerate compose and re-exec binary on update ([#576](#576)) ([3f226eb](3f226eb)) ### CI/CD * add SBOM generation to Docker and CLI releases ([#580](#580)) ([db459cf](db459cf)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #595 +/- ##
=======================================
Coverage 92.46% 92.46%
=======================================
Files 551 551
Lines 27681 27681
Branches 2678 2678
=======================================
Hits 25595 25595
Misses 1634 1634
Partials 452 452 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Code Review
This pull request addresses a failing CI release process by removing the problematic SBOM generation for CLI binaries. The changes include removing the sboms configuration from .goreleaser.yml, updating the CI documentation in CLAUDE.md to reflect this, and resetting the project version from 0.3.7 back to 0.3.6 across multiple files to allow for a clean release attempt. The changes are consistent and directly address the issue described.
Summary
Syft cannot scan Go binary archives (
.tar.gz/.zip) -- it tries to interpret them as container images and fails. Since CLI binaries are statically linked withCGO_ENABLED=0, there are no runtime dependencies to catalog. Docker image SBOMs (generated by the Docker workflow via syft on actual container images) remain unchanged.This is the third v0.3.7 release attempt. Previous failures:
../LICENSEpath resolution (fixed in fix(cli): auto-delete binary on Windows, prune images, fix GoReleaser #590)file:$artifactstill failed on archive auto-detection (this PR removes it)Changes
cli/.goreleaser.yml: Removesboms:stanza entirely.github/workflows/cli.yml: Remove*.cdx.jsonfrom upload glob, removeCLI_SBOM_DATAHTML comment block.github/workflows/finalize-release.yml: RemoveCLI_SBOMextraction, simplify SBOM rendering to container-onlyCLAUDE.md: Remove CLI SBOM references from CI documentationTest plan
🤖 Generated with Claude Code
Summary by CodeRabbit