[vineethsai7]

What changed

• Preserve the CycloneDX serialNumber generated by cyclonedx-py.
• Validate the SBOM fields required by actions/attest before attempting attestation.

Root cause

The release workflow used --output-reproducible, which intentionally omits the CycloneDX serialNumber. The pinned GitHub attestation action requires that field to recognize CycloneDX JSON, causing release run 30858915389 to fail before publishing.

Impact

New release runs can attest the generated SBOM and continue to upload release assets and publish the package.

Validation

• Generated and stamped a CycloneDX 1.6 SBOM locally.
• Confirmed it contains bomFormat, specVersion, and a UUID serialNumber.
• Parsed the workflow YAML successfully.
• Passed repository pre-commit checks, including GitHub workflow validation.
• Passed git diff --check.

Summary by CodeRabbit

• Bug Fixes
  • Improved software bill of materials validation to ensure required metadata is present.
  • Enhanced release attestations by including the SBOM serial number and verifying its specification version.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 06836a44-ea08-43df-9eb5-ee6f9c8c51c1

📥 Commits

Reviewing files that changed from the base of the PR and between ec7c7f0 and 6d73928.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The release workflow now generates a CycloneDX SBOM without reproducible output mode and validates its format, serial number, and specification version after stamping.

Changes

SBOM release workflow

Layer / File(s)	Summary
SBOM generation and validation .github/workflows/release.yml	SBOM generation removes --output-reproducible. Validation checks the CycloneDX format and requires nonempty serialNumber and specVersion fields. Version and package URL stamping remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• cisco-ai-defense/skill-scanner#143: Introduced the SBOM generation and validation logic extended by this change.

Suggested reviewers: ob-aion

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-sbom-attestation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}