He-Pin commented on issue #1736: URL: https://github.com/apache/pekko/issues/1736#issuecomment-4958564637
I investigated this in Pekko and reproduced the published `pekko-persistence-testkit_2.12:1.1.3` SBOM entries for `pekko-actor-tests`, `pekko-remote-tests`, and `pekko-actor-typed-tests`. The Pekko POM and Compile classpath correctly treat these internal projects as test-only. The leak happens in `sbt-sbom`: sbt's `UpdateReport` can retain test-only inter-project modules as disconnected nodes in the Compile report, and the plugin converted every reported module into a required SBOM component. I submitted the root fix upstream rather than adding a Pekko-specific `-tests` name filter: - https://github.com/sbt/sbt-sbom/pull/247 The fix limits components and dependency-tree nodes to modules reachable from the current project root. Its scripted regression test covers direct and transitive Compile/Test project dependencies on both sbt 1 / Scala 2.12 and sbt 2 / Scala 3. I also published the fixed plugin locally and generated the current Pekko `persistence-testkit` SBOM. All three reported test artifacts were absent, normal Compile dependencies remained, and every dependency reference resolved correctly. Once the upstream change is released, Pekko can update `sbt-sbom` to pick up the fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
