From e7691d9a973e91943cfa9e869ba9c3cf579234a4 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 25 Jun 2026 14:56:30 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20(ci):=20Fix=20+=20pin=20cycloned?= =?UTF-8?q?x=20SBOM=20flag=20in=20release-python.yml?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The SBOM step used --outfile, which the latest cyclonedx-bom CLI no longer accepts (renamed to -o/--output-file), failing the release with exit 2. Unpinned uvx --from cyclonedx-bom pulled the drifting latest. Use the correct --output-file flag and pin cyclonedx-bom==7.3.0 so the CLI surface stays stable across releases. Closes AAASM-3722 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release-python.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml index 5bfedd72..9e576d9a 100644 --- a/.github/workflows/release-python.yml +++ b/.github/workflows/release-python.yml @@ -166,7 +166,7 @@ jobs: - name: Generate CycloneDX SBOM # cyclonedx-py walks the resolved virtualenv and emits a CycloneDX # JSON BOM of every installed distribution. - run: uvx --from cyclonedx-bom cyclonedx-py environment .venv --output-format JSON --outfile sbom.cdx.json + run: uvx --from cyclonedx-bom==7.3.0 cyclonedx-py environment .venv --output-format JSON --output-file sbom.cdx.json - name: Upload SBOM artifact uses: actions/upload-artifact@v7 with: