adityamparikh opened a new pull request, #259: URL: https://github.com/apache/solr-mcp/pull/259
cyclonedx 3.4.1 writes the SBOM to `build/reports/cyclonedx/application.cdx.json`. That is the path the license-notice plugin already reads (`buildSrc/src/main/kotlin/org.apache.solr.mcp.license-notice.gradle.kts:96`) and the one AGENTS.md documents. Both workflows still read `build/reports/application.cdx.json`, which no longer exists. What that breaks today: - **build-and-publish.yml**: "Upload SBOM artifact" matches no file. `upload-artifact@v4` defaults to `if-no-files-found: warn`, so the step passes and the artifact is silently missing. The latest main run ([38251714095](https://github.com/apache/solr-mcp/actions/runs/38251714095), on `7cb39a3d`) uploaded `solr-mcp-jar`, `test-results` and `coverage-report`, but no `solr-mcp-sbom`. - **release-publish.yml**: the `cp` in "Attach SBOM to GitHub Release" exits non-zero. That fails `publish-docker`, and `publish-mcp-registry` (`needs: [..., publish-docker, ...]`) never runs. This workflow only runs after a release vote, so nothing has hit it yet. Changes: - Point both workflows at `build/reports/cyclonedx/application.cdx.json`. - Set `if-no-files-found: error` on both SBOM uploads, so a future change to the report path fails the job instead of dropping the artifact. Verified locally: `./gradlew build` on this branch writes `build/reports/cyclonedx/application.cdx.json` and nothing at the old path. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
