This is an automated email from the ASF dual-hosted git repository.
epugh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr-mcp.git
The following commit(s) were added to refs/heads/main by this push:
new b1f3dfe6 ci: read the SBOM from build/reports/cyclonedx/ (#259)
b1f3dfe6 is described below
commit b1f3dfe609e89fd52cd03b0565dde055f3e9697d
Author: Aditya Parikh <[email protected]>
AuthorDate: Mon Oct 26 15:35:17 2026 -0400
ci: read the SBOM from build/reports/cyclonedx/ (#259)
cyclonedx 3.4.1 writes the SBOM to
build/reports/cyclonedx/application.cdx.json
(the path the license-notice plugin already reads), but both workflows still
pointed at build/reports/application.cdx.json.
- build-and-publish.yml: the "Upload SBOM artifact" step finds no file and,
with upload-artifact's default if-no-files-found: warn, passes anyway.
Runs
on main produce no solr-mcp-sbom artifact.
- release-publish.yml: the cp in "Attach SBOM to GitHub Release" fails,
which
fails publish-docker and skips publish-mcp-registry, which needs it.
Point both at the real path and set if-no-files-found: error on both uploads
so a future path change fails the build instead of dropping the artifact.
Signed-off-by: Aditya Parikh <[email protected]>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
---
.github/workflows/build-and-publish.yml | 5 +++--
.github/workflows/release-publish.yml | 7 ++++---
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/build-and-publish.yml
b/.github/workflows/build-and-publish.yml
index c38e6e5d..7c9b3448 100644
--- a/.github/workflows/build-and-publish.yml
+++ b/.github/workflows/build-and-publish.yml
@@ -132,7 +132,7 @@ jobs:
retention-days: 7
# Upload the CycloneDX SBOM produced during the build
- # build/reports/application.cdx.json is generated by the cyclonedx
+ # build/reports/cyclonedx/application.cdx.json is generated by the
cyclonedx
# Gradle plugin and is also embedded in the bootable JAR. Retained
# for 30 days (longer than the standard 7) because supply-chain
# investigations often happen well after a build.
@@ -141,7 +141,8 @@ jobs:
uses: actions/upload-artifact@v4
with:
name: solr-mcp-sbom
- path: build/reports/application.cdx.json
+ path: build/reports/cyclonedx/application.cdx.json
+ if-no-files-found: error
retention-days: 30
# Upload JUnit test results
diff --git a/.github/workflows/release-publish.yml
b/.github/workflows/release-publish.yml
index f52f7717..f14bfd37 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -246,7 +246,7 @@ jobs:
- name: Generate SBOM (Software Bill of Materials)
# The CycloneDX plugin is wired in build.gradle.kts; bootJar already
# depends on cyclonedxBom transitively. Running it explicitly here
- # ensures build/reports/application.cdx.json exists for the upload
+ # ensures build/reports/cyclonedx/application.cdx.json exists for the
upload
# steps below even if the `Build project` step above used a cached
# bootJar output.
run: ./gradlew cyclonedxBom
@@ -258,7 +258,8 @@ jobs:
# The release_version input is constrained by validate-release; safe
to
# interpolate into the artifact name.
name: solr-mcp-sbom-${{ inputs.release_version }}
- path: build/reports/application.cdx.json
+ path: build/reports/cyclonedx/application.cdx.json
+ if-no-files-found: error
retention-days: 90
- name: Attach SBOM to GitHub Release
@@ -271,7 +272,7 @@ jobs:
RELEASE_VERSION: ${{ inputs.release_version }}
run: |
# Rename to include the version so the asset is unambiguous on the
release page.
- cp build/reports/application.cdx.json
"solr-mcp-${RELEASE_VERSION}.cdx.json"
+ cp build/reports/cyclonedx/application.cdx.json
"solr-mcp-${RELEASE_VERSION}.cdx.json"
# --clobber lets re-runs of this workflow replace a previously
uploaded SBOM.
# If the v<version> GitHub Release does not exist yet, log and
continue —
# the workflow artifact above is still captured.
