v0.6.4
Pre-release
fix(sbom): merge the UI lockfile, and correct what 0.6.2 claimed
The released sbom-wardynd.cdx.json for 0.6.3 carries 1,070 components: 114 Go
modules, 4 Debian packages, and ZERO of the 611 npm packages actually in the
bundle. 0.6.2's notes said switching syft from the source tree to the pushed
image fixed that. It did not, and could not: wardynd embeds the console as a Vite
bundle, which strips every package.json, so there is no manifest in the image for
any scanner to find however you point it. Changing the scan TARGET fixed the
OS-package blindness and nothing else.
The plan I wrote said the fix was to merge a lockfile-derived scan. I implemented
the target change, saw "scans the image now", and did not check the number — the
one number the whole change was about.
The lockfile is the only place those versions still exist, so the release merges
syft dir:ui into the image SBOM. Rehearsed against the actual 0.6.3 artifact:
1,681 components, 611 npm, 114 golang, 4 deb.
The job now FAILS when the merge leaves zero npm packages. An SBOM that
understates what it describes is the failure this whole campaign is about, and it
shipped anyway because nothing asserted the outcome — only that a file existed.
Signed-off-by: cjohnstoniv cjohnstoniv@users.noreply.github.com