feat: adopt bomly-sdk v0.7.0 and resolve repositories from origins - #1
Merged
Conversation
The mechanical half matches the other plugin migrations: sdk.Dependency becomes sdk.DependencyNode, fixtures route through the testkit constructors because identity is minted there and the fields holding it are unexported. The half that is not mechanical, and the reason this repo was flagged: this matcher resolved a package's GitHub repository by reading the PURL's repository_url / vcs_url / download_url qualifiers. ADR-0041 relocates those out of a package PURL and into origins when a node is constructed, so that step now finds nothing for any package that came through the graph. The failure would have been silent. Resolution returns "", the package is never scored, and the result is indistinguishable from a package that has no GitHub source -- the tests stayed green through the bump, which is exactly why the plan called this bump behavioural. resolveRepo now reads Package.DetectedOrigins first, which is the vetted ADR-0033 evidence phase 1.4 added for this. A repository claim outranks an artifact URL: the first names a source repository, the second is a download location that happens to be hosted on GitHub. The qualifier step is kept after it, since a PURL from an ingested SBOM never went through a node constructor and can still carry them. Delegation: dropped the github.com/anchore/packageurl-go import for purlkit.Parse. The fork was the deprecated path the SDK removed at v0.6.0; purlkit is the kit over the official packageurl-go. Two mutations verified: removing the origins step reproduces the silent regression, and preferring an artifact URL over a repository claim resolves a mirror instead of the source.
The migration was developed against the release candidate through a go.work overlay; this pins the published tag. v0.8.0 rather than v0.7.1 because the SDK fixes added exported API, which is a minor bump under semver -- gorelease named the version. Full suite green under -race against the real tag, with no overlay.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration to
bomly-sdkv0.7.0. This is the repo the plan flagged as behavioural rather than mechanical, and the reason is worth reading before approving.The silent regression this fixes
resolveRepofound a package's GitHub repository by reading the PURL'srepository_url/vcs_url/download_urlqualifiers. ADR-0041 relocates those out of a package PURL and into origins at node construction — so that step now finds nothing for any package that came through the graph.The failure mode is the dangerous one: resolution returns
"", the package is never scored, and the result is indistinguishable from a package that genuinely has no GitHub source. The existing tests stayed green through the bump. Nothing would have told us.resolveReponow readsPackage.DetectedOriginsfirst — the vetted ADR-0033 evidence phase 1.4 added for exactly this. A repository claim outranks an artifact URL: the first names a source repository, the second is a download location that happens to be GitHub-hosted (a mirror tarball would otherwise win over the real source). The qualifier step is kept after it, since a PURL from an ingested SBOM never went through a node constructor and can still carry them.Delegation
Dropped
github.com/anchore/packageurl-goforpurlkit.Parse. The fork was the deprecated path the SDK removed at v0.6.0; purlkit is the kit over the officialpackageurl-go.Mechanical half
Matches the other eight:
sdk.Dependency→sdk.DependencyNode, and fixtures route through thetestkitconstructors because identity is minted there and the fields holding it are unexported.Verification
Two mutations: removing the origins step reproduces the silent regression; preferring an artifact URL over a repository claim resolves a mirror instead of the source.
go vet,gofmt,go mod tidy, full suite under-race— clean.🤖 Generated with Claude Code