What's wrong
CI run 30452427240, job "SBOM (CycloneDX)" (id 90577608071) shows a green checkmark, but cargo-cyclonedx never writes bom.json, and the upload-artifact step only warns rather than failing when the file is missing. The run's annotations contain:
##[warning]No files were found with the provided path: bom.json. No artifacts will be uploaded.
directly attributed to this job.
Why it matters
The job is presented (and reads in the Actions UI) as a passing SBOM-generation step, but it silently produces nothing. Anyone relying on the CycloneDX SBOM being generated and available per build (for supply-chain/compliance purposes) would not notice it's missing without digging into the run's annotations.
Suggested fix
Investigate why cargo-cyclonedx isn't producing bom.json in this job (likely a working-directory or output-path mismatch), and change the upload-artifact step to if-no-files-found: error so the job fails loudly instead of silently succeeding when the SBOM isn't produced.
Filed from the RELAY ecosystem audit (2026-07-29), category: relay-spec-conformance, severity: medium.
What's wrong
CI run 30452427240, job "SBOM (CycloneDX)" (id 90577608071) shows a green checkmark, but
cargo-cyclonedxnever writesbom.json, and theupload-artifactstep only warns rather than failing when the file is missing. The run's annotations contain:directly attributed to this job.
Why it matters
The job is presented (and reads in the Actions UI) as a passing SBOM-generation step, but it silently produces nothing. Anyone relying on the CycloneDX SBOM being generated and available per build (for supply-chain/compliance purposes) would not notice it's missing without digging into the run's annotations.
Suggested fix
Investigate why
cargo-cyclonedxisn't producingbom.jsonin this job (likely a working-directory or output-path mismatch), and change theupload-artifactstep toif-no-files-found: errorso the job fails loudly instead of silently succeeding when the SBOM isn't produced.Filed from the RELAY ecosystem audit (2026-07-29), category: relay-spec-conformance, severity: medium.