diff --git a/README.md b/README.md index 3054105..e294662 100644 --- a/README.md +++ b/README.md @@ -84,7 +84,7 @@ Project: [`sbom-diff-and-risk`](tools/sbom-diff-and-risk/README.md) Status: -Stable GitHub release: `v1.0.0`. Production PyPI publishing remains deferred. +Stable GitHub release: `v1.1.0`. Production PyPI publishing remains deferred. What to review: Deterministic SBOM/dependency diffing, JSON/Markdown/SARIF output, local policy @@ -98,6 +98,7 @@ Useful entry points: - [Reviewer path](tools/sbom-diff-and-risk/docs/reviewer-path.md) - [Reviewer brief](tools/sbom-diff-and-risk/docs/reviewer-brief.md) - [Reviewer evidence pack](tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md) +- [v1.1.0 release notes][release-notes-v110] - [v1.0.0 release notes][release-notes-v100] - [v1.0-rc.1 release notes][release-notes-v10rc1] - [Examples](tools/sbom-diff-and-risk/examples/) @@ -225,12 +226,13 @@ the review question: ## Status -- Current stable flagship release: `sbom-diff-and-risk` `v1.0.0` -- GitHub Release assets: available for `v1.0.0` -- GitHub Latest: `v1.0.0` -- Package metadata: `1.0.0` +- Current stable flagship release: `sbom-diff-and-risk` `v1.1.0` +- GitHub Release assets: available for `v1.1.0` +- GitHub Latest: `v1.1.0` +- Package metadata: `1.1.0` - TestPyPI Trusted Publishing dry-run: completed - Production PyPI publishing: intentionally deferred +[release-notes-v110]: tools/sbom-diff-and-risk/RELEASE_NOTES_v1.1.0.md [release-notes-v100]: tools/sbom-diff-and-risk/RELEASE_NOTES_v1.0.0.md [release-notes-v10rc1]: tools/sbom-diff-and-risk/RELEASE_NOTES_v1.0-rc.1.md diff --git a/scripts/validate-reviewer-routes.py b/scripts/validate-reviewer-routes.py index 22dd29f..0bb4646 100644 --- a/scripts/validate-reviewer-routes.py +++ b/scripts/validate-reviewer-routes.py @@ -176,8 +176,8 @@ "not a package safety verdict engine", "not part of the `sbom-diff-and-risk` release surface", "why the scientific-computing background helps", - "Current stable flagship release: `sbom-diff-and-risk` `v1.0.0`", - "GitHub Latest: `v1.0.0`", + "Current stable flagship release: `sbom-diff-and-risk` `v1.1.0`", + "GitHub Latest: `v1.1.0`", "Production PyPI publishing: intentionally deferred", ), Path("docs/reviewer-brief.md"): ( @@ -267,9 +267,9 @@ "any malware verdict", ), Path("tools/sbom-diff-and-risk/docs/release-provenance.md"): ( - "`v1.0.0` is the stable GitHub Release contract and is marked GitHub Latest", + "`v1.1.0` is the stable GitHub Release contract and is marked GitHub Latest", "Production PyPI publishing remains deferred as a separate contract", - "marks final tags such as `v1.0.0` as GitHub Latest", + "marks final tags such as `v1.1.0` as GitHub Latest", "workflow artifact attestation", ), Path("tools/sbom-diff-and-risk/docs/reviewer-path.md"): ( @@ -288,7 +288,7 @@ "runs the tool, uploads `policy.json`, and fails or passes from the policy exit code", "not current PyPI package truth", "not current repository reputation", - "`v1.0.0` is the stable GitHub release and GitHub Latest", + "`v1.1.0` is the stable GitHub release and GitHub Latest", "`v1.0-rc.1` remains historical prerelease evidence", "It does not decide whether a dependency is safe.", ), diff --git a/tools/sbom-diff-and-risk/README.md b/tools/sbom-diff-and-risk/README.md index 8f081f3..0d034e1 100644 --- a/tools/sbom-diff-and-risk/README.md +++ b/tools/sbom-diff-and-risk/README.md @@ -1,6 +1,6 @@ # sbom-diff-and-risk -`v1.0.0` is the stable Policy Evidence GitHub release. GitHub Release assets +`v1.1.0` is the stable Policy Evidence GitHub release. GitHub Release assets are the supported distribution surface for this version, while production PyPI publishing remains intentionally deferred. diff --git a/tools/sbom-diff-and-risk/RELEASE_NOTES_v1.1.0.md b/tools/sbom-diff-and-risk/RELEASE_NOTES_v1.1.0.md new file mode 100644 index 0000000..ace39a5 --- /dev/null +++ b/tools/sbom-diff-and-risk/RELEASE_NOTES_v1.1.0.md @@ -0,0 +1,71 @@ +# sbom-diff-and-risk v1.1.0 + +`v1.1.0` is the stable v1.1 GitHub Release for `sbom-diff-and-risk`. + +The Python package metadata version for this tag is `1.1.0`. The package +authors metadata is intentionally omitted; the public package identity remains +the repository and project name. + +## Highlights + +- Adds input and policy contract versioning while preserving readable v1.0 + policy and report fields. +- Adds policy decision explainability with stable rule, evidence, reason, + and confidence fields. +- Adds typed canonical component identity with fail-closed duplicate and + conflicting-metadata diagnostics. +- Adds an explicit ecosystem canonicalization matrix for PyPI, npm, Maven, + NuGet, generic, and unknown ecosystems. +- Treats a no-purl `bom_ref` as an opaque local identifier: surrounding + whitespace is trimmed, case is preserved, and local identifiers are not + inferred to be aliases. +- Keeps the local CI consumer path, JSON/Markdown/SARIF report surfaces, and + release artifact verification path available for reviewers. + +## Compatibility + +- CLI commands and flags remain unchanged. +- Existing v1.0 report fields remain readable for the lifetime of report + schema v1. +- Legacy policy files remain readable while versioned policy schema identifiers + are emitted and validated. +- Purl identity remains authoritative over `bom_ref`; a version change remains + a change rather than an add/remove pair. +- Case-differing opaque bom-refs no longer collide. Exact duplicate identities + and same-identity conflicting metadata still fail closed. + +## Release policy + +- `v1.1.0` is the stable GitHub Release contract and GitHub Latest. +- GitHub Release assets are the supported distribution surface for this + version. +- Production PyPI publishing remains intentionally deferred. +- TestPyPI Trusted Publishing evidence remains evidence of the test publishing + path only. + +## Boundaries + +- Default analysis remains local-file based and deterministic. +- Optional PyPI and OpenSSF Scorecard enrichment remains explicit opt-in + network access. +- No CVE lookup, advisory resolution, malware scanning, or package safety + verdict was added. +- Policy warnings and failures remain bounded local policy decisions, not + third-party safety verdicts. + +## Release evidence + +The tag-gated GitHub Actions workflow builds the wheel and source distribution, +normalizes build timestamps from the tagged commit time, generates a SHA256 +checksum manifest, records workflow artifact attestations, and publishes the +same built files as GitHub Release assets. Final tags are explicitly marked as +GitHub Latest; rc tags remain prereleases. + +Expected assets: + +- `sbom_diff_and_risk-1.1.0-py3-none-any.whl` +- `sbom_diff_and_risk-1.1.0.tar.gz` +- `sbom-diff-and-risk-SHA256SUMS.txt` + +Use `docs/verification.md`, `docs/release-provenance.md`, and +`docs/self-provenance.md` for the correct verification path. diff --git a/tools/sbom-diff-and-risk/docs/github-actions-consumer-example.md b/tools/sbom-diff-and-risk/docs/github-actions-consumer-example.md index 9845f77..0b31407 100644 --- a/tools/sbom-diff-and-risk/docs/github-actions-consumer-example.md +++ b/tools/sbom-diff-and-risk/docs/github-actions-consumer-example.md @@ -12,7 +12,7 @@ Production PyPI publishing is intentionally deferred, so consumers should not install `sbom-diff-and-risk` from production PyPI. Use a GitHub Release asset or a local checkout instead. -The checked-in workflow pins the stable GitHub Release contract, `v1.0.0`. +The checked-in workflow pins the stable GitHub Release contract, `v1.1.0`. ## Minimal policy workflow @@ -49,15 +49,15 @@ jobs: GH_TOKEN: ${{ github.token }} run: | mkdir -p .tooling/sbom-diff-risk - gh release download v1.0.0 \ + gh release download v1.1.0 \ --repo stacknil/scientific-computing-toolkit \ - --pattern "sbom_diff_and_risk-1.0.0-py3-none-any.whl" \ + --pattern "sbom_diff_and_risk-1.1.0-py3-none-any.whl" \ --dir .tooling/sbom-diff-risk - name: Install sbom-diff-risk run: | python -m pip install \ - .tooling/sbom-diff-risk/sbom_diff_and_risk-1.0.0-py3-none-any.whl + .tooling/sbom-diff-risk/sbom_diff_and_risk-1.1.0-py3-none-any.whl - name: Run dependency policy id: compare diff --git a/tools/sbom-diff-and-risk/docs/release-provenance.md b/tools/sbom-diff-and-risk/docs/release-provenance.md index 7ac17ed..d7dfc75 100644 --- a/tools/sbom-diff-and-risk/docs/release-provenance.md +++ b/tools/sbom-diff-and-risk/docs/release-provenance.md @@ -9,17 +9,17 @@ This document is about the second surface: verifying a GitHub Release and a down This page is only about the `sbom-diff-and-risk` tool's own GitHub Releases. If you want the quick "which verification page do I need?" guide, start with [verification.md](verification.md). -## v1.0 release policy +## v1.1 release policy -`v1.0.0` is the stable GitHub Release contract and is marked GitHub Latest. +`v1.1.0` is the stable GitHub Release contract and is marked GitHub Latest. Production PyPI publishing remains deferred as a separate contract. -For `v1.0.0`, stability applies to the CLI, report schemas, policy decision +For `v1.1.0`, stability applies to the CLI, report schemas, policy decision examples, evidence-confidence labels, reviewer case, and GitHub Release asset verification path. It does not claim production PyPI availability. The tag workflow marks rc tags as prereleases and not Latest. It explicitly -marks final tags such as `v1.0.0` as GitHub Latest. +marks final tags such as `v1.1.0` as GitHub Latest. Release assets produced by the updated workflow also include a deterministic SHA256 checksum manifest named `sbom-diff-and-risk-SHA256SUMS.txt`. The manifest is written with filenames sorted in a stable order. It is not a separate provenance system; it is a local byte-integrity check that helps reviewers confirm downloaded wheel and source distribution files match the hashes published with the same GitHub Release. diff --git a/tools/sbom-diff-and-risk/docs/reviewer-brief.md b/tools/sbom-diff-and-risk/docs/reviewer-brief.md index 78b1faf..4869b48 100644 --- a/tools/sbom-diff-and-risk/docs/reviewer-brief.md +++ b/tools/sbom-diff-and-risk/docs/reviewer-brief.md @@ -4,7 +4,7 @@ `sbom-diff-and-risk` is a local CLI for comparing two SBOMs or dependency manifests and producing deterministic review artifacts: JSON, Markdown, and SARIF. It is built for conservative supply-chain review, not for vulnerability scanning or package reputation scoring. -Current stable GitHub release: `v1.0.0`. Production PyPI remains deferred. +Current stable GitHub release: `v1.1.0`. Production PyPI remains deferred. For the shortest ordered review route, use [reviewer-path.md](reviewer-path.md). diff --git a/tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md b/tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md index e89b011..456b593 100644 --- a/tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md +++ b/tools/sbom-diff-and-risk/docs/reviewer-evidence-pack.md @@ -14,7 +14,7 @@ workflow templates. `sbom-diff-and-risk` is a local-first deterministic CLI for comparing SBOMs and dependency manifests. It is designed to produce stable review evidence for dependency changes. -Current stable GitHub release: `v1.0.0`. +Current stable GitHub release: `v1.1.0`. Core identity: @@ -149,19 +149,19 @@ For CI dashboard, job-summary, and local-threshold examples that consume ## Release Verification Path -Start with the GitHub Release for the version under review. For `v1.0.0`, +Start with the GitHub Release for the version under review. For `v1.1.0`, inspect the release and assets: ```powershell -gh release view v1.0.0 ` +gh release view v1.1.0 ` --repo stacknil/scientific-computing-toolkit ` --json tagName,name,isDraft,isPrerelease,assets,url ``` Expected release assets: -- `sbom_diff_and_risk-1.0.0-py3-none-any.whl` -- `sbom_diff_and_risk-1.0.0.tar.gz` +- `sbom_diff_and_risk-1.1.0-py3-none-any.whl` +- `sbom_diff_and_risk-1.1.0.tar.gz` - `sbom-diff-and-risk-SHA256SUMS.txt` For this stable release, `isPrerelease` should be `false`. @@ -194,13 +194,13 @@ For workflow-built artifacts downloaded from a trusted workflow run, verify artifact attestations with the signer workflow: ```powershell -gh attestation verify path/to/sbom_diff_and_risk-1.0.0-py3-none-any.whl ` +gh attestation verify path/to/sbom_diff_and_risk-1.1.0-py3-none-any.whl ` --repo stacknil/scientific-computing-toolkit ` --signer-workflow stacknil/scientific-computing-toolkit/.github/workflows/sbom-diff-and-risk-ci.yml ``` ```powershell -gh attestation verify path/to/sbom_diff_and_risk-1.0.0.tar.gz ` +gh attestation verify path/to/sbom_diff_and_risk-1.1.0.tar.gz ` --repo stacknil/scientific-computing-toolkit ` --signer-workflow stacknil/scientific-computing-toolkit/.github/workflows/sbom-diff-and-risk-ci.yml ``` @@ -210,15 +210,15 @@ releases. Use them only when the repository release is immutable and GitHub has generated release attestations: ```powershell -gh release view v1.0.0 --repo stacknil/scientific-computing-toolkit --json isImmutable,assets,url +gh release view v1.1.0 --repo stacknil/scientific-computing-toolkit --json isImmutable,assets,url ``` If `isImmutable` is true, release verification can check the release record and downloaded release assets: ```powershell -gh release verify v1.0.0 --repo stacknil/scientific-computing-toolkit -gh release verify-asset v1.0.0 path/to/sbom_diff_and_risk-1.0.0-py3-none-any.whl --repo stacknil/scientific-computing-toolkit +gh release verify v1.1.0 --repo stacknil/scientific-computing-toolkit +gh release verify-asset v1.1.0 path/to/sbom_diff_and_risk-1.1.0-py3-none-any.whl --repo stacknil/scientific-computing-toolkit ``` If `isImmutable` is false, use the workflow artifact attestation path as the primary artifact verification story. diff --git a/tools/sbom-diff-and-risk/docs/reviewer-path.md b/tools/sbom-diff-and-risk/docs/reviewer-path.md index 0b8345d..56bd0ae 100644 --- a/tools/sbom-diff-and-risk/docs/reviewer-path.md +++ b/tools/sbom-diff-and-risk/docs/reviewer-path.md @@ -199,7 +199,7 @@ Use this section only when the review question is about the released `sbom-diff-and-risk` tool artifacts. It is not the path for judging third-party dependency safety. -Release status: `v1.0.0` is the stable GitHub release and GitHub Latest. +Release status: `v1.1.0` is the stable GitHub release and GitHub Latest. `v1.0-rc.1` remains historical prerelease evidence. Production PyPI publishing is still deferred as a separate contract. diff --git a/tools/sbom-diff-and-risk/examples/github-actions-policy-consumer.yml b/tools/sbom-diff-and-risk/examples/github-actions-policy-consumer.yml index 491a87c..8f44c2e 100644 --- a/tools/sbom-diff-and-risk/examples/github-actions-policy-consumer.yml +++ b/tools/sbom-diff-and-risk/examples/github-actions-policy-consumer.yml @@ -29,15 +29,15 @@ jobs: GH_TOKEN: ${{ github.token }} run: | mkdir -p .tooling/sbom-diff-risk - gh release download v1.0.0 \ + gh release download v1.1.0 \ --repo stacknil/scientific-computing-toolkit \ - --pattern "sbom_diff_and_risk-1.0.0-py3-none-any.whl" \ + --pattern "sbom_diff_and_risk-1.1.0-py3-none-any.whl" \ --dir .tooling/sbom-diff-risk - name: Install sbom-diff-risk run: | python -m pip install \ - .tooling/sbom-diff-risk/sbom_diff_and_risk-1.0.0-py3-none-any.whl + .tooling/sbom-diff-risk/sbom_diff_and_risk-1.1.0-py3-none-any.whl - name: Run dependency policy id: compare diff --git a/tools/sbom-diff-and-risk/examples/sample-policy-warn-report.sarif b/tools/sbom-diff-and-risk/examples/sample-policy-warn-report.sarif index 60720ec..0796502 100644 --- a/tools/sbom-diff-and-risk/examples/sample-policy-warn-report.sarif +++ b/tools/sbom-diff-and-risk/examples/sample-policy-warn-report.sarif @@ -7,8 +7,8 @@ "driver": { "name": "sbom-diff-risk", "fullName": "sbom-diff-risk", - "version": "1.1.0.dev0", - "semanticVersion": "1.1.0.dev0", + "version": "1.1.0", + "semanticVersion": "1.1.0", "rules": [ { "id": "sdr.new_package", diff --git a/tools/sbom-diff-and-risk/examples/sample-provenance-report.sarif b/tools/sbom-diff-and-risk/examples/sample-provenance-report.sarif index 5f04371..2735804 100644 --- a/tools/sbom-diff-and-risk/examples/sample-provenance-report.sarif +++ b/tools/sbom-diff-and-risk/examples/sample-provenance-report.sarif @@ -7,8 +7,8 @@ "driver": { "name": "sbom-diff-risk", "fullName": "sbom-diff-risk", - "version": "1.1.0.dev0", - "semanticVersion": "1.1.0.dev0", + "version": "1.1.0", + "semanticVersion": "1.1.0", "rules": [ { "id": "sdr.policy_violation.provenance_required", diff --git a/tools/sbom-diff-and-risk/examples/sample-sarif.sarif b/tools/sbom-diff-and-risk/examples/sample-sarif.sarif index c8ad93f..2de6df7 100644 --- a/tools/sbom-diff-and-risk/examples/sample-sarif.sarif +++ b/tools/sbom-diff-and-risk/examples/sample-sarif.sarif @@ -7,8 +7,8 @@ "driver": { "name": "sbom-diff-risk", "fullName": "sbom-diff-risk", - "version": "1.1.0.dev0", - "semanticVersion": "1.1.0.dev0", + "version": "1.1.0", + "semanticVersion": "1.1.0", "rules": [ { "id": "sdr.major_upgrade", diff --git a/tools/sbom-diff-and-risk/examples/sample-scorecard-report.sarif b/tools/sbom-diff-and-risk/examples/sample-scorecard-report.sarif index 761976c..09ba470 100644 --- a/tools/sbom-diff-and-risk/examples/sample-scorecard-report.sarif +++ b/tools/sbom-diff-and-risk/examples/sample-scorecard-report.sarif @@ -7,8 +7,8 @@ "driver": { "name": "sbom-diff-risk", "fullName": "sbom-diff-risk", - "version": "1.1.0.dev0", - "semanticVersion": "1.1.0.dev0", + "version": "1.1.0", + "semanticVersion": "1.1.0", "rules": [ { "id": "sdr.policy_violation.scorecard_below_threshold", diff --git a/tools/sbom-diff-and-risk/pyproject.toml b/tools/sbom-diff-and-risk/pyproject.toml index 9638e3c..d21b5d3 100644 --- a/tools/sbom-diff-and-risk/pyproject.toml +++ b/tools/sbom-diff-and-risk/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "sbom-diff-and-risk" -version = "1.1.0.dev0" +version = "1.1.0" description = "Deterministic SBOM diff CLI with heuristic risk reporting." readme = { file = "PYPI_DESCRIPTION.md", content-type = "text/markdown" } requires-python = ">=3.11" diff --git a/tools/sbom-diff-and-risk/src/sbom_diff_risk/__init__.py b/tools/sbom-diff-and-risk/src/sbom_diff_risk/__init__.py index 9576422..07dffbf 100644 --- a/tools/sbom-diff-and-risk/src/sbom_diff_risk/__init__.py +++ b/tools/sbom-diff-and-risk/src/sbom_diff_risk/__init__.py @@ -2,4 +2,4 @@ __all__ = ["__version__"] -__version__ = "1.1.0.dev0" +__version__ = "1.1.0" diff --git a/tools/sbom-diff-and-risk/tests/test_ci_consumer_demo.py b/tools/sbom-diff-and-risk/tests/test_ci_consumer_demo.py index ce89503..9e26111 100644 --- a/tools/sbom-diff-and-risk/tests/test_ci_consumer_demo.py +++ b/tools/sbom-diff-and-risk/tests/test_ci_consumer_demo.py @@ -40,8 +40,8 @@ def test_policy_consumer_uploads_policy_json_before_enforcing_exit_code() -> Non assert "--out-md" not in text assert "--out-sarif" not in text assert "tee " not in text - assert "gh release download v1.0.0" in text - assert "sbom_diff_and_risk-1.0.0-py3-none-any.whl" in text + assert "gh release download v1.1.0" in text + assert "sbom_diff_and_risk-1.1.0-py3-none-any.whl" in text run_index = step_names.index("Run dependency policy") upload_index = step_names.index("Upload policy JSON") diff --git a/tools/sbom-diff-and-risk/tests/test_release_workflow.py b/tools/sbom-diff-and-risk/tests/test_release_workflow.py index 121eae4..d211b44 100644 --- a/tools/sbom-diff-and-risk/tests/test_release_workflow.py +++ b/tools/sbom-diff-and-risk/tests/test_release_workflow.py @@ -11,6 +11,7 @@ WORKFLOW = REPO_ROOT / ".github" / "workflows" / "sbom-diff-and-risk-ci.yml" RELEASE_NOTES = REPO_ROOT / "tools" / "sbom-diff-and-risk" / "RELEASE_NOTES_v1.0-rc.1.md" FINAL_RELEASE_NOTES = REPO_ROOT / "tools" / "sbom-diff-and-risk" / "RELEASE_NOTES_v1.0.0.md" +V1_1_RELEASE_NOTES = REPO_ROOT / "tools" / "sbom-diff-and-risk" / "RELEASE_NOTES_v1.1.0.md" PYPROJECT = REPO_ROOT / "tools" / "sbom-diff-and-risk" / "pyproject.toml" PACKAGE_INIT = REPO_ROOT / "tools" / "sbom-diff-and-risk" / "src" / "sbom_diff_risk" / "__init__.py" ROOT_README = REPO_ROOT / "README.md" @@ -54,16 +55,17 @@ def test_release_workflow_normalizes_build_timestamps_before_checksums() -> None assert epoch_index < build_index < normalize_index < checksum_index -def test_main_development_metadata_and_v1_stable_status_are_aligned() -> None: +def test_main_release_metadata_and_v1_stable_status_are_aligned() -> None: project = tomllib.loads(PYPROJECT.read_text(encoding="utf-8"))["project"] package_init = PACKAGE_INIT.read_text(encoding="utf-8") root_readme = ROOT_README.read_text(encoding="utf-8") tool_readme = TOOL_README.read_text(encoding="utf-8") - assert project["version"] == "1.1.0.dev0" - assert '__version__ = "1.1.0.dev0"' in package_init - assert "Current stable flagship release: `sbom-diff-and-risk` `v1.0.0`" in root_readme - assert "`v1.0.0` is the stable Policy Evidence GitHub release" in tool_readme + assert project["version"] == "1.1.0" + assert "authors" not in project + assert '__version__ = "1.1.0"' in package_init + assert "Current stable flagship release: `sbom-diff-and-risk` `v1.1.0`" in root_readme + assert "`v1.1.0` is the stable Policy Evidence GitHub release" in tool_readme assert "final candidate" not in root_readme assert "final candidate" not in tool_readme @@ -79,12 +81,23 @@ def test_v1_release_notes_capture_rc_compatibility_boundary() -> None: assert "Production PyPI publishing remains deferred" in text -def test_main_sarif_golden_fixtures_use_development_version() -> None: +def test_v1_1_release_notes_capture_identity_and_contract_boundaries() -> None: + text = V1_1_RELEASE_NOTES.read_text(encoding="utf-8") + + assert "# sbom-diff-and-risk v1.1.0" in text + assert "input and policy contract versioning" in text + assert "policy decision explainability" in text + assert "canonical component identity" in text + assert "opaque local identifier" in text + assert "Production PyPI publishing remains intentionally deferred" in text + + +def test_main_sarif_golden_fixtures_use_release_version() -> None: fixtures = sorted(EXAMPLES.glob("sample-*.sarif")) assert fixtures for fixture in fixtures: payload = json.loads(fixture.read_text(encoding="utf-8")) driver = payload["runs"][0]["tool"]["driver"] - assert driver["version"] == "1.1.0.dev0", fixture.name - assert driver["semanticVersion"] == "1.1.0.dev0", fixture.name + assert driver["version"] == "1.1.0", fixture.name + assert driver["semanticVersion"] == "1.1.0", fixture.name