fix(release): remove --pyproject filter from SBOM to match full environment lock - #147
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47f23f5c86
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The evidence script validates that environment.lock (pip list --format=freeze) exactly matches the SBOM package closure. When cyclonedx-py is invoked with --pyproject pyproject.toml, the SBOM places engraphis itself in metadata.component (the root component) rather than in the components array. _python_sbom_packages() only iterated components, so the root package was missing from the SBOM set and the lock comparison failed with: 'build environment lock and Python SBOM package closure differ' Fix: also extract the purl/name/version from metadata.component when present. This preserves the --pyproject flag (which correctly identifies engraphis as the SBOM root component) while making the lock comparison account for it.
47f23f5 to
1c8ba55
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c8ba55e38
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem\n\nThe release workflow's
Generate public release evidencejob fails with:\n\nrelease_evidence.py: error: build environment lock and Python SBOM package closure differ\n\n\nThis blocks the downstreamPublish to PyPIjob, preventing trusted publishing for v1.6.1 and v1.7.\n\n## Root Cause\n\nThe SBOM generation step in.github/workflows/release.ymluses--pyproject pyproject.toml, which filters the CycloneDX SBOM to only declared dependencies. Meanwhile, the environment lock file is captured viapip list --format=freeze, which includes the full installed environment (transitive deps, build tools, etc.).\n\nTherelease_evidence.pyscript (line 284) validates that these two sets are exactly equal, so the mismatch causes a hard failure.\n\n## Fix\n\nRemove the--pyproject pyproject.tomlfilter from thecyclonedx-py environmentinvocation so both artifacts capture the same full installed environment.\n\n## After Merge\n\nTagsv1.6.1andv1.7must be moved to the newmainHEAD and force-pushed to retrigger the release workflow (the evidence and publish jobs only run on tag push events).