feat: adopt bomly-sdk v0.3.0 helper packages - #382
Open
bomly-guy wants to merge 3 commits into
Open
Conversation
Replace CLI-internal helper packages with their verbatim moves in bomly-sdk v0.3.0 (every exported identifier preserved): - internal/system -> github.com/bomly-dev/bomly-sdk/system - internal/matchers/cache -> github.com/bomly-dev/bomly-sdk/filecache - internal/matchers (root) -> github.com/bomly-dev/bomly-sdk/matcherkit - internal/testutil -> github.com/bomly-dev/bomly-sdk/testkit - internal/logging (command half: SanitizeArgs/SanitizeURL/CommandFields/ CommandStderr/NewCommandStderr) -> github.com/bomly-dev/bomly-sdk/logkit - internal/detectors root helpers (InferManifestMetadata, positions, remediation hints, SubgraphFrom, JavaReady, build-tool timeout, RequestWorkingDir) -> github.com/bomly-dev/bomly-sdk/detectorkit internal/logging keeps the console/pretty-encoder half; internal/detectors keeps names.go (detector name constants). Tests that covered the moved helpers now live in the SDK and are deleted here. Import rewrites use aliases matching the old package names so call sites are unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thread the CLI build version into registry wiring so embedded components see the same sdk.RuntimeInfo.CoreVersion a managed plugin receives: - config.Resolved gains an untagged CoreVersion field populated by the root command at startup (not user configuration; no flag/env/YAML key). - registry.Configs gains CoreVersion, filled by RegistryConfigsFromResolved. - embeddedHostContext.Runtime() now reports that version alongside sdk.ExecutionEmbedded, with test coverage in module_test.go. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
Important Review skippedToo many files! This PR contains 183 files, which is 83 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (183)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| github.com/bodgit/sevenzip v1.6.1 // indirect | ||
| github.com/bodgit/windows v1.0.1 // indirect | ||
| github.com/bomly-dev/bomly-sdk v0.2.0 | ||
| github.com/bomly-dev/bomly-sdk v0.3.0 |
Collaborator
Author
There was a problem hiding this comment.
I verified LICENSE (Apache-2.0, 11,340 bytes) exists at the bomly-sdk v0.3.0 tag — the "license unknown" alert is registry indexing lag on the fresh tag; no action needed. Leaving this thread open for the bot to clear.
🤖 Addressed by Claude Code
Contributor
Bomly Diff SummaryCompared Overview
Dependency ChangesSummary: 0 added, 1 version changed, 0 detail changes, 0 removed. Changed Dependencies
Vulnerabilities✅ No vulnerability changes. License ChangesSummary: 0 added, 1 changed, 0 removed. Changed Licenses
Project Posture✅ No project posture changes ( Policy FindingsSummary: 1 introduced, 0 persisted, 0 resolved. Introduced Findings
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 54019c60fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…lding Prepare the repo for in-repo component modules under components/<kind>/<name>/: - Commit go.work (root module only for now; extraction waves add use ./components/... entries) and go.work.sum. - GoReleaser builds set GOWORK=off explicitly so releases resolve from go.mod pins only. - New pinned-build CI job runs go build/test with GOWORK=off; gated to pushes to main because component pseudo-versions only resolve post-merge. - New scripts/release-components.sh (make release-components): dry run prints per-module patch tags for component modules changed since their last components/<path>/vX.Y.Z tag; --apply creates and pushes the tags and prints the root go get pin bumps. - Ignore accidental root-level build outputs (/bomly, /bomly-lite). - CLAUDE.md / AGENTS.md: document the components/ layout, workspace mode, one-atomic-PR wave convention, the release train, and the bomly-sdk helper subpackages that replaced internal/system, internal/matchers/cache, internal/testutil, and the command half of internal/logging. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bomly-guy
force-pushed
the
feat/sdk-helpers-adoption
branch
from
August 12, 2026 07:57
54019c6 to
2f3523a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Foundation step F1 of the component-extraction program: the CLI adopts the helper subpackages released in bomly-sdk v0.3.0, gains CoreVersion plumbing for embedded components, and picks up the workspace/release-train scaffolding the upcoming component-module waves build on.
What moved where
Every subpackage is a verbatim move of CLI internals (all exported identifiers preserved), so this is a pure import rewrite:
internal/systemsysteminternal/matchers/cachefilecacheinternal/matchersroot (RegistryPackagesForGraph,MissingLicensePackages,NormalizeLicenseSet)matcherkitinternal/testutiltestkit(plus newRequireLockfilePositions)internal/loggingcommand half (SanitizeArgs,SanitizeURL,CommandFields,CommandStderr,NewCommandStderr)logkitinternal/detectorsroot helpers (InferManifestMetadata, positions +ScanLines,BuildRemediationHints+RemediationAdvice,SubgraphFrom,JavaReady+CommandNotReadyError,BuildToolContext+ timeout,RequestWorkingDir)detectorkitinternal/loggingkeeps the console/pretty-encoder half;internal/detectorskeepsnames.go(detector name constants). Tests covering the moved helpers now live in the SDK and are deleted here. Import rewrites alias the SDK packages to the old package names, so call sites are unchanged; files that mixed kept and moved identifiers dual-import (detectorkit/logkit).CoreVersion plumbing
config.Resolvedgains an untaggedCoreVersionfield populated by the root command from the build version (no flag/env/YAML key; generated docs unaffected).RegistryConfigsFromResolvedthreads it into the newregistry.Configs.CoreVersion, andembeddedHostContext.Runtime()now reports it alongsidesdk.ExecutionEmbedded, so embedded components see the samesdk.RuntimeInfoa managed plugin receives.Workspace + release-train scaffolding
Preparation for in-repo component modules under
components/<kind>/<name>/(no modules exist yet):go.work/go.work.sum(root module only; waves adduse ./components/...entries).GOWORK=offexplicitly so releases resolve fromgo.modpins only.pinned-buildCI job (GOWORK=off go build+go test ./internal/... ./cmd/...), gated to pushes tomainbecause component pseudo-versions only resolve post-merge.scripts/release-components.sh(make release-components): dry run prints per-module patch tags for component modules changed since their lastcomponents/<path>/vX.Y.Ztag;--applycreates/pushes the tags and prints the rootgo getpin bumps.CLAUDE.md/AGENTS.mddocument the layout, workspace mode, one-atomic-PR wave convention, and the SDK helper subpackages.Verification
make build(full + lite), fullgo test ./...,go vet ./...,gofmt -lclean.make generate: no drift.make fuzz FUZZTIME=2sgreen;TestExamplePluginFixtureCompilesgreen against the v0.3.0 pin.🤖 Generated with Claude Code