Copilot commented on code in PR #14570:
URL: https://github.com/apache/cloudstack/pull/14570#discussion_r4513240181
##########
.github/workflows/sbom.yml:
##########
@@ -35,15 +35,18 @@ jobs:
with:
persist-credentials: false
+ - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e #
v6.4.0
+ with:
+ node-version: 24
Review Comment:
The PR description indicates the generator needs Node 20.18+; pinning to
Node 24 may increase the risk of unexpected breakage if Node 24 behavior
changes or isn’t consistently available across runners. Consider pinning to a
specific supported LTS/minimum version (e.g., 20.18.x or an LTS line) that
satisfies the stated requirement.
##########
.github/workflows/sbom.yml:
##########
@@ -62,7 +65,7 @@ jobs:
uses: ./.github/actions/setup-env
- name: Generate Java SBOM
- run: mvn -B -ntp -Dnoredist
org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
+ run: mvn -B -ntp -Dnoredist -Psbom
org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
Review Comment:
The PR description states the java-sbom job no longer needs a build and
should run `mvn -Dnoredist -Psbom validate` (leveraging the profile-bound
execution). The workflow still invokes the plugin goal directly; switching this
step to run `validate` would match the documented behavior and ensure the
profile’s configured execution is what runs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
