CI: pr-cve-check broken - cve-check.bbclass removed from OE-core master

[rpcme]

Problem

The pr-cve-check workflow fails on all PRs targeting master-next with:

ParseError in configuration INHERITs: Could not inherit file classes/cve-check.bbclass

Root Cause

OE-core master removed cve-check.bbclass on March 31, 2026 in commit 00de455 by Ross Burton. The class has been replaced by sbom-cve-check (Bootlin).

Our workflow clones OE-core at master HEAD and uses INHERIT += "cve-check", which no longer exists.

Impact

• All PRs to master-next have a failing pr-cve-check status
• No CVE scanning on PRs until fixed
• The nightly-cve-check workflow is likely also affected

Fix

Migrate pr-cve-check.yml (and nightly-cve-check.yml if affected) to use sbom-cve-check which is now integrated into OE-core via the SPDX classes.

Key changes needed:

• Replace INHERIT += "cve-check" with the sbom-cve-check equivalent
• Replace bitbake -c cve_check with the new scanning command
• Update result parsing (output format may differ)

Workaround

The pr-cve-check workflow has been temporarily disabled until migration is complete.

References

• OE-core removal commit: 00de455f8d3aeca880129d23e8cfb7e246404699
• sbom-cve-check: https://github.com/bootlin/sbom-cve-check
• Upstream discussion: https://lore.kernel.org/openembedded-core/2CD10DD9-FB2A-4B10-B98A-85918EB6B4B7@arm.com/

[rpcme]

Migration Plan: cve-check → sbom-cve-check

The replacement is already in OE-core master. Two classes available:

For PR-level CVE checking (our use case)

# Old (removed):
INHERIT += "cve-check"
bitbake -c cve_check <recipes>

# New:
INHERIT += "sbom-cve-check-recipe"
bitbake -c sbom_cve_check_recipe <recipes>

Key differences

• Uses SPDX/SBOM data instead of the old CVE database
• Requires python3-sbom-cve-check-native (already in OE-core)
• Output format is different — need to update result parsing
• Has SBOM_CVE_CHECK_SCAN_SCOPE variable (target vs both)
• Depends on do_create_recipe_sbom task

Files to update

1. .github/workflows/pr-cve-check.yml — replace inherit + bitbake command
2. Update result parsing (old: cve-summary.json, new: SBOM-based output)
3. Re-enable PR trigger for master-next

Blocked by

Nothing — can be implemented now.