also looking at this
fix(ci): gate release publishing on SBOM scan
#314
5 files
+44
-9
| @@ -25,9 +25,13 @@ jobs: | ||
| 25 | 25 | release-sbom: |
| 26 | 26 | needs: validate-release |
| 27 | 27 | uses: ./.github/workflows/sbom.yml |
| 28 | with: | |
| 29 | enforce_high: true | |
| 28 | 30 | |
| 29 | 31 | pantry: |
| 30 | needs: [validate-release] | |
| 32 | # The reusable SBOM workflow includes the vulnerability scan. Publishing | |
| 33 | # must wait for its existing Critical gate, not merely attach it afterward. | |
| 34 | needs: [validate-release, release-sbom] | |
| 31 | 35 | name: pantry (${{ matrix.platform.name }}) |
| 32 | 36 | strategy: |
| 33 | 37 | fail-fast: false |
| @@ -65,7 +69,7 @@ jobs: | ||
| 65 | 69 | run: ${{ matrix.platform.deps }} |
| 66 | 70 | |
| 67 | 71 | - name: Install Dependencies |
| 68 | run: bun install | |
| 72 | run: bun install --frozen-lockfile | |
| 69 | 73 | |
| 70 | 74 | - name: Extract Version |
| 71 | 75 | id: version |
| @@ -532,7 +536,7 @@ jobs: | ||
| 532 | 536 | - name: Setup Pantry (provides Bun, Zig, etc.) |
| 533 | 537 | uses: pantry-pm/pantry/packages/action@235036fa0f48bae99b2293df5a3dc35c809b1777 # pinned: last SHA whose bundled typescript resolves on linux-x64 |
| 534 | 538 | - name: Install Dependencies |
| 535 | run: bun install | |
| 539 | run: bun install --frozen-lockfile | |
| 536 | 540 | |
| 537 | 541 | - name: Test package regressions |
| 538 | 542 | run: bun run test:packages |