feat: add user-agent header

[alexanderbsingh]

Adds a User-Agent header to the SBOM upload request. The User-Agent is bifrost-cli/<version>, where the version is the latest version tag plus the current commit, number of commits off from the release and -dirty if built with uncomited changes. A clean example bifrost-cli/v0.1.4 and a "dirty" example bifrsot-cli/v0.1.4-4-g82f64fd-dirty

[Copilot]

Pull request overview

This PR adds a User-Agent header to SBOM upload HTTP requests, intending to identify the CLI as bifrost-cli/<version> where the version is derived from Git metadata and/or release inputs.

Changes:

• Thread the CLI version from CLI(...) → NewSBOMUploadTask(...) → NewAPI(...) and set User-Agent on upload requests.
• Update tests to assert the new User-Agent header is present.
• Adjust build plumbing (Makefile + GitHub Actions) to pass version/commit information into the build.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Makefile	Makes VERSION/GIT_COMMIT overridable and embeds them via -ldflags for runtime version reporting.
internal/bifrost/sbom_upload.go	Passes the CLI version into API construction for request header population.
internal/bifrost/cli.go	Updates SBOM upload task construction to include the CLI version.
internal/bifrost/cli_test.go	Adds assertion that the CLI-driven upload includes User-Agent.
internal/bifrost/api.go	Adds userAgent handling and sets User-Agent on the upload request.
internal/bifrost/api_test.go	Adds User-Agent assertions and updates most NewAPI call sites for the new signature.
.github/workflows/build.yaml	Updates version derivation and propagates version/commit through environment into make build-all.

Comments suppressed due to low confidence (1)

internal/bifrost/api.go:45

• NewAPI now requires an extra version argument, but there is still at least one call site using the old signature (e.g. internal/bifrost/api_test.go:85 in TestAPI_UploadSBOM_EscapesServiceAndVersionPathSegments), which will cause compilation failures. Update the remaining call(s) to pass a version string (or "" to omit the /version suffix in the User-Agent).

func NewAPI(serverURL string, token string, retryAttempts int, retryDelay time.Duration, gitBranch string, gitCommitSHA string, gitOrigin string, version string) API {
	if retryAttempts < 0 {
		retryAttempts = 0
	}
	if retryDelay < 0 {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.