fix(ci): keep generated SBOMs out of the crate/PyPI publish path (+ CI pin) - #50

Merged

Navi Bot (project-navi-bot) merged 11 commits into

mainfrom

fix/sbom-excluded-from-pypi-upload

May 25, 2026

Commits on May 25, 2026

ci: keep generated SBOMs out of the crate/PyPI publish path
Nelson Spence (Fieldnote-Echo)
committed
d59c13d
test: pin the release-publish SBOM invariants in CI
Nelson Spence (Fieldnote-Echo)
committed
fad8038
Merge branch 'main' into fix/sbom-excluded-from-pypi-upload
Navi Bot (project-navi-bot)
authored
a39139f
Merge branch 'main' into fix/sbom-excluded-from-pypi-upload
Navi Bot (project-navi-bot)
authored
ae9994c
test(ci): harden release-publish SBOM guard (anchor steps, enforce download->clean->publish order)
Nelson Spence (Fieldnote-Echo)
committed
679e91a
fix(ci): require an actual deletion in the SBOM-cleanup guard
Nelson Spence (Fieldnote-Echo)
committed
80c1bb9
ci: pin release-guard checkout to a commit SHA (qodo review)
Nelson Spence (Fieldnote-Echo)
committed
1e44a80
fix(ci): scope SBOM guard to the publish job + accept multi-line run: (qodo)
Nelson Spence (Fieldnote-Echo)
committed
49b97db
ci: least-privilege contents:read on the release-guard job (qodo)
Nelson Spence (Fieldnote-Echo)
committed
6ad1b3f
fix(ci): match SBOM delete only in executing run: context (Codex review)
Nelson Spence (Fieldnote-Echo)
committed
4815952
fix(ci): keep run: block detection intact across shell # comment lines (Codex)
Nelson Spence (Fieldnote-Echo)
committed
58a2fac