bugfix: broken release pipeline

[Schmarvinius]

Fix Broken Release Pipeline

🐛 Bug Fix: Resolved issues in the release pipeline related to BlackDuck scanning and the build process.

Changes

• .github/actions/build/action.yml: Added a step to install @sap/cds-dk@9.9.1 globally via npm before the Maven build step.

• .github/actions/scan-with-blackduck/action.yml:

  • Added a new version input parameter to accept the project version externally (e.g., a release tag), replacing the previously inline Get Revision step that derived the version from Maven.
  • Removed the Get Revision step that used mvn help:evaluate to extract the revision.
  • Updated --detect.project.version.name to use ${{ inputs.version }} instead of the now-removed step output.
  • Added --detect.project.group.name=CDSJAVA-OPEN-SOURCE to the BlackDuck detect arguments.

• .github/workflows/release.yml: Passes ${{ github.event.release.tag_name }} as the version input to the scan-with-blackduck action, ensuring the release tag is used as the BlackDuck project version.

• 🔄 Regenerate and Update Summary

PR Bot Information

Version: 1.20.51

• File Content Strategy: Full file content
• LLM: anthropic--claude-4.6-sonnet
• Output Template: Default Template
• Event Trigger: pull_request.opened
• Summary Prompt: Default Prompt
• Correlation ID: 73c79ced-02c3-45cb-8c6b-57b8f39aa2a1

[hyperspace-insights]

The PR is in good shape overall, but it introduces a breaking change: the new version input in scan-with-blackduck/action.yml is declared required: true, yet the existing main.yml workflow that calls this action in RAPID scan mode does not supply it — this will cause the CI-MAIN pipeline to fail after merge. The version input should either be made optional with a sensible default, or main.yml must be updated to pass a value (e.g. the commit SHA or branch name).

PR Bot Information

Version: 1.20.51

• Agent Instructions:
  • CLAUDE.md
• File Content Strategy: Full file content
• LLM: anthropic--claude-4.6-sonnet
• Event Trigger: pull_request.opened
• Correlation ID: 73c79ced-02c3-45cb-8c6b-57b8f39aa2a1

[hyperspace-insights]

Bug: The new version input is marked required: true, but the main.yml workflow's blackduck job calls this action without supplying version. This will cause the CI-MAIN workflow to fail after this PR merges.

The main.yml scan runs in RAPID mode (pre-merge/nightly) where no release tag exists, so a sensible fallback would be to either make version optional with a default (e.g. the branch name or commit SHA), or derive it inside the action when the input is absent.

Consider making version optional and providing a default, for example the git commit SHA, or add a fallback step inside the action:

  version:
    description: The project version to report to Black Duck (e.g. release tag).
    required: false
    default: ''

And then derive it inside the action when it is empty (e.g. via git rev-parse --short HEAD).

---

Please provide feedback on the review comment by checking the appropriate box:

• 🌟 Awesome comment, a human might have missed that.
• ✅ Helpful comment
• 🤷 Neutral
• ❌ This comment is not helpful