feat: adopt bomly-sdk v0.7.0 - #1
Merged
Merged
Conversation
Mechanical migration to the typed GraphNode union: sdk.Dependency becomes sdk.DependencyNode, and fixtures route through the testkit constructors, because identity is minted there and the fields holding it are unexported -- a hand-built literal has no node ID at all. The migration surfaced a user-visible regression that shipped in v0.7.0, and it is fixed in the SDK rather than here: NormalizeLicenseSet wrote this matcher's name into PackageLicense.Type, which phase 1.4 turned into the closed declared/concluded vocabulary, so the model gate silently emptied the "licenses[].source" field the docs promise. bomly-sdk#31 gives a license source its own field. This repo needs no change for it beyond the pin. BLOCKED on a v0.7.1 tag carrying bomly-sdk#31. Verified locally against that branch through a go.work overlay; the pin here is still v0.7.0 and must be bumped once the tag exists, which is the one line left on this PR.
NormalizeLicenseSet's second argument is a license type -- "declared" or "concluded" -- and always was; this matcher was passing a matcher name into it, which is how the name reached a field that later became a closed vocabulary. It now calls NormalizeLicenseSetFrom, which takes the two as the independent facts they are.
The migration was developed against the release candidate through a go.work overlay; this pins the published tag. v0.8.0 rather than v0.7.1 because the SDK fixes added exported API, which is a minor bump under semver -- gorelease named the version. Full suite green under -race against the real tag, with no overlay.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mechanical migration to the typed
GraphNodeunion:sdk.Dependency→sdk.DependencyNode, and fixtures route through thetestkitconstructors because identity is minted there and the fields holding it are unexported — a hand-built literal has no node ID at all.Why this one is blocked
The migration surfaced a user-visible regression that shipped in v0.7.0.
matcherkit.NormalizeLicenseSetwrote this matcher's name intoPackageLicense.Type; phase 1.4 turnedTypeinto the closeddeclared/concludedvocabulary, so the model gate silently emptied it — andlicenses[].sourceis a fielddocs/matchers/depsdev-license-matcher.mdpromises and the CLI publishes.It surfaced here only because a fixture comparison printed
Type:""whereType:"external-depsdev"was expected. Nothing else would have caught it.The fix belongs in the SDK, not here (ADR-0040): a license source is an independent fact from the kind of claim, and they were sharing one field. bomly-sdk#31 gives it its own. This repo needs no change for it beyond the pin.
Verification
go vet,gofmt, full suite — clean against the SDK branch.🤖 Generated with Claude Code