Skip to content

fix(sbom): mark v1.1 main as development #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stacknil merged 1 commit into from
Jul 15, 2026
Merged

fix(sbom): mark v1.1 main as development #112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions tools/sbom-diff-and-risk/examples/sample-policy-warn-report.sarif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
"driver": {
"name": "sbom-diff-risk",
"fullName": "sbom-diff-risk",
"version": "1.0.0",
"semanticVersion": "1.0.0",
"version": "1.1.0.dev0",
"semanticVersion": "1.1.0.dev0",
"rules": [
{
"id": "sdr.new_package",
Expand Down
4 changes: 2 additions & 2 deletions tools/sbom-diff-and-risk/examples/sample-provenance-report.sarif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
"driver": {
"name": "sbom-diff-risk",
"fullName": "sbom-diff-risk",
"version": "1.0.0",
"semanticVersion": "1.0.0",
"version": "1.1.0.dev0",
"semanticVersion": "1.1.0.dev0",
"rules": [
{
"id": "sdr.policy_violation.provenance_required",
Expand Down
4 changes: 2 additions & 2 deletions tools/sbom-diff-and-risk/examples/sample-sarif.sarif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
"driver": {
"name": "sbom-diff-risk",
"fullName": "sbom-diff-risk",
"version": "1.0.0",
"semanticVersion": "1.0.0",
"version": "1.1.0.dev0",
"semanticVersion": "1.1.0.dev0",
"rules": [
{
"id": "sdr.major_upgrade",
Expand Down
4 changes: 2 additions & 2 deletions tools/sbom-diff-and-risk/examples/sample-scorecard-report.sarif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
"driver": {
"name": "sbom-diff-risk",
"fullName": "sbom-diff-risk",
"version": "1.0.0",
"semanticVersion": "1.0.0",
"version": "1.1.0.dev0",
"semanticVersion": "1.1.0.dev0",
"rules": [
{
"id": "sdr.policy_violation.scorecard_below_threshold",
Expand Down
2 changes: 1 addition & 1 deletion tools/sbom-diff-and-risk/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"

[project]
name = "sbom-diff-and-risk"
version = "1.0.0"
version = "1.1.0.dev0"
description = "Deterministic SBOM diff CLI with heuristic risk reporting."
readme = { file = "PYPI_DESCRIPTION.md", content-type = "text/markdown" }
requires-python = ">=3.11"
Expand Down
2 changes: 1 addition & 1 deletion tools/sbom-diff-and-risk/src/sbom_diff_risk/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@

__all__ = ["__version__"]

__version__ = "1.0.0"
__version__ = "1.1.0.dev0"
12 changes: 6 additions & 6 deletions tools/sbom-diff-and-risk/tests/test_release_workflow.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,14 +54,14 @@ def test_release_workflow_normalizes_build_timestamps_before_checksums() -> None
assert epoch_index < build_index < normalize_index < checksum_index


def test_v1_release_metadata_and_public_status_are_aligned() -> None:
def test_main_development_metadata_and_v1_stable_status_are_aligned() -> None:
project = tomllib.loads(PYPROJECT.read_text(encoding="utf-8"))["project"]
package_init = PACKAGE_INIT.read_text(encoding="utf-8")
root_readme = ROOT_README.read_text(encoding="utf-8")
tool_readme = TOOL_README.read_text(encoding="utf-8")

assert project["version"] == "1.0.0"
assert '__version__ = "1.0.0"' in package_init
assert project["version"] == "1.1.0.dev0"
assert '__version__ = "1.1.0.dev0"' in package_init
assert "Current stable flagship release: `sbom-diff-and-risk` `v1.0.0`" in root_readme
assert "`v1.0.0` is the stable Policy Evidence GitHub release" in tool_readme
assert "final candidate" not in root_readme
Expand All @@ -79,12 +79,12 @@ def test_v1_release_notes_capture_rc_compatibility_boundary() -> None:
assert "Production PyPI publishing remains deferred" in text


def test_v1_sarif_golden_fixtures_use_final_version() -> None:
def test_main_sarif_golden_fixtures_use_development_version() -> None:
fixtures = sorted(EXAMPLES.glob("sample-*.sarif"))

assert fixtures
for fixture in fixtures:
payload = json.loads(fixture.read_text(encoding="utf-8"))
driver = payload["runs"][0]["tool"]["driver"]
assert driver["version"] == "1.0.0", fixture.name
assert driver["semanticVersion"] == "1.0.0", fixture.name
assert driver["version"] == "1.1.0.dev0", fixture.name
assert driver["semanticVersion"] == "1.1.0.dev0", fixture.name