aienvmp 0.1.48 → 0.1.49
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/BUGFIXES.md +6 -0
- package/CHANGELOG.md +10 -0
- package/README.md +2 -1
- package/action.yml +12 -0
- package/examples/github-action.yml +3 -0
- package/package.json +1 -1
package/BUGFIXES.md
CHANGED
|
@@ -76,6 +76,12 @@ Short record of bugs, fixes, and follow-up checks.
|
|
|
76
76
|
- Fix: `aienvmp sbom --format cyclonedx-lite` and `.aienvmp/sbom.cdx.json` now export project-manifest packages in a CycloneDX-compatible shape with explicit limitations.
|
|
77
77
|
- Verification: tests cover component mapping, vulnerability hints, sync output, schema metadata, and dashboard links.
|
|
78
78
|
|
|
79
|
+
### CI example did not surface SBOM artifacts clearly
|
|
80
|
+
|
|
81
|
+
- Issue: sync could generate SBOM artifacts, but the GitHub Action and example upload list did not make them explicit.
|
|
82
|
+
- Fix: the Action now has `write-sbom` and the example uploads both native and CycloneDX-lite SBOM artifacts.
|
|
83
|
+
- Verification: Action tests cover input metadata, SBOM write commands, and example artifact paths.
|
|
84
|
+
|
|
79
85
|
## Template
|
|
80
86
|
|
|
81
87
|
### Title
|
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.1.49
|
|
4
|
+
|
|
5
|
+
- Added a `write-sbom` GitHub Action input for explicit SBOM artifact generation.
|
|
6
|
+
- Added Action steps for writing `.aienvmp/sbom.json` and `.aienvmp/sbom.cdx.json`.
|
|
7
|
+
- Updated the GitHub Action example to enable SBOM writing.
|
|
8
|
+
- Added native light SBOM artifact upload paths to the example workflow.
|
|
9
|
+
- Added CycloneDX-lite artifact upload paths to the example workflow.
|
|
10
|
+
- Updated README CI usage to mention SBOM artifacts.
|
|
11
|
+
- Added regression coverage for Action SBOM inputs, commands, and example upload paths.
|
|
12
|
+
|
|
3
13
|
## 0.1.48
|
|
4
14
|
|
|
5
15
|
- Added `aienvmp sbom --format cyclonedx-lite` for a lightweight CycloneDX-compatible export.
|
package/README.md
CHANGED
|
@@ -87,13 +87,14 @@ aienvmp doctor --strict security|policy|coordination|all
|
|
|
87
87
|
|
|
88
88
|
## CI
|
|
89
89
|
|
|
90
|
-
The GitHub Action writes status, schema, doctor, plan, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
|
|
90
|
+
The GitHub Action writes status, schema, doctor, plan, SBOM, and dashboard artifacts. `strict: "off"` reports warnings without failing the job.
|
|
91
91
|
|
|
92
92
|
```yaml
|
|
93
93
|
- uses: soovwv/aienvmp@main
|
|
94
94
|
with:
|
|
95
95
|
write-status: "true"
|
|
96
96
|
write-plan: "true"
|
|
97
|
+
write-sbom: "true"
|
|
97
98
|
strict: "off"
|
|
98
99
|
```
|
|
99
100
|
|
package/action.yml
CHANGED
|
@@ -27,6 +27,10 @@ inputs:
|
|
|
27
27
|
description: Write doctor JSON with advisory/strict exit behavior
|
|
28
28
|
required: false
|
|
29
29
|
default: "true"
|
|
30
|
+
write-sbom:
|
|
31
|
+
description: Write standalone light SBOM and CycloneDX-lite artifacts
|
|
32
|
+
required: false
|
|
33
|
+
default: "true"
|
|
30
34
|
|
|
31
35
|
runs:
|
|
32
36
|
using: composite
|
|
@@ -65,6 +69,14 @@ runs:
|
|
|
65
69
|
node "$GITHUB_ACTION_PATH/bin/aienvmp.js" doctor --dir "${{ inputs.directory }}" --json > "${{ inputs.directory }}/.aienvmp/doctor.json"
|
|
66
70
|
fi
|
|
67
71
|
|
|
72
|
+
- name: Write SBOM artifacts
|
|
73
|
+
shell: bash
|
|
74
|
+
run: |
|
|
75
|
+
if [ "${{ inputs.write-sbom }}" = "true" ]; then
|
|
76
|
+
node "$GITHUB_ACTION_PATH/bin/aienvmp.js" sbom --dir "${{ inputs.directory }}" --write --quiet
|
|
77
|
+
node "$GITHUB_ACTION_PATH/bin/aienvmp.js" sbom --dir "${{ inputs.directory }}" --format cyclonedx-lite --write --quiet
|
|
78
|
+
fi
|
|
79
|
+
|
|
68
80
|
- name: Doctor
|
|
69
81
|
shell: bash
|
|
70
82
|
run: |
|
|
@@ -16,6 +16,7 @@ jobs:
|
|
|
16
16
|
write-plan: "true"
|
|
17
17
|
write-schema: "true"
|
|
18
18
|
write-doctor-json: "true"
|
|
19
|
+
write-sbom: "true"
|
|
19
20
|
strict: "off" # security, policy, coordination, all, or off
|
|
20
21
|
|
|
21
22
|
- uses: actions/upload-artifact@v4
|
|
@@ -26,6 +27,8 @@ jobs:
|
|
|
26
27
|
AIENV.md
|
|
27
28
|
.aienvmp/manifest.json
|
|
28
29
|
.aienvmp/status.json
|
|
30
|
+
.aienvmp/sbom.json
|
|
31
|
+
.aienvmp/sbom.cdx.json
|
|
29
32
|
.aienvmp/schema.json
|
|
30
33
|
.aienvmp/doctor.json
|
|
31
34
|
.aienvmp/plan.json
|