From f1fed6cdd5fcc000e2d4471f2a6738a96eb775f5 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Sat, 30 May 2026 19:26:30 +0200 Subject: [PATCH] ci(release): fix CycloneDX SBOM generation (cargo-cyclonedx has no -p flag) (#79) cargo-cyclonedx 0.5.9 walks the whole workspace in a single pass and writes a .cdx.json next to each member's Cargo.toml; it has no -p/--package selector. The previous three 'cargo cyclonedx ... -p ' invocations aborted with 'error: unexpected argument -p found', failing the cargo-publish job after the crates were already published and, in turn, skipping the github-release attach-assets job (it needs all four publish jobs). v0.3.0 published to every registry but got no GitHub Release page or SBOM assets as a result. Replace the three invalid calls with a single workspace pass and copy the three crates.io crate SBOMs into the upload dir. --- .github/workflows/release.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6cafefa9..4694f19d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -90,11 +90,15 @@ jobs: - name: Generate CycloneDX SBOMs run: | - cargo cyclonedx --format json --top-level -p wickra-core - cargo cyclonedx --format json --top-level -p wickra-data - cargo cyclonedx --format json --top-level -p wickra + # cargo-cyclonedx walks the whole workspace in a single pass and + # writes a .cdx.json next to each member's Cargo.toml; it + # has no -p/--package selector. Collect the three crates.io crates + # (the .crate files published by this job) into the upload dir. + cargo cyclonedx --format json --top-level mkdir -p sboms - find . -name "*.cdx.json" -not -path "./target/*" -exec cp {} sboms/ \; + cp crates/wickra-core/wickra-core.cdx.json sboms/ + cp crates/wickra-data/wickra-data.cdx.json sboms/ + cp crates/wickra/wickra.cdx.json sboms/ ls -lh sboms/ - name: Upload SBOMs