AI feedback

Author: simolus3

.github/workflows/build.yml

@@ -146,7 +146,6 @@ jobs:
 
   libs_android:
     name: Building Android libraries
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     runs-on: ubuntu-latest
     outputs:
       artifact_id: ${{ steps.upload.outputs.artifact-id }}
@@ -177,7 +176,7 @@ jobs:
       
       - name: Build signed library
         shell: bash
-        if: ${{ inputs.sign-publication == '1' }}
+        if: ${{ inputs.sign-publication }}
         run: |
           cd android
           ./gradlew build zipPublication  -PgpgKey=${INPUTS_GPG_KEY} -PgpgPassword=${INPUTS_GPG_PASSWORD}
@@ -189,7 +188,7 @@ jobs:
 
       - name: Build library without signing
         shell: bash
-        if: ${{ inputs.sign-publication == '0' }}
+        if: ${{ !inputs.sign-publication }}
         run: |
           cd android
           ./gradlew build zipPublication -PsignPublication=0
@@ -231,7 +230,6 @@ jobs:
 
   libs_wasm:
     name: Basic WASM build
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     runs-on: ubuntu-latest
     outputs:
       artifact_id: ${{ steps.upload.outputs.artifact-id }}
@@ -257,7 +255,6 @@ jobs:
 
   libs_xcframework:
     name: Build XCFramework
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     runs-on: macos-latest
     outputs:
       artifact_id: ${{ steps.upload.outputs.artifact-id }}

dart/tool/generate_sbom.dart

@@ -7,7 +7,13 @@ import 'package:uuid/uuid.dart';
 ///
 /// Usage: `dart tool/generate_sbom.dart > bom.json`
 void main() async {
+  // The first library is the core extension itself (the powersync_core crate).
+  // The crate we actually compile as binaries is powersync_static or
+  // powersync_loadable, but these contain no additional dependencies.
   final [coreExtension, ...dependencies] = await findDependencies();
+  if (coreExtension.name != 'powersync_core') {
+    throw 'Unexpected root: ${coreExtension.name}';
+  }
 
   const journeyApps = {
     'name': 'JourneyApps',
@@ -18,8 +24,7 @@ void main() async {
     'bomFormat': 'CycloneDX',
     'specVersion': '1.7',
     'serialNumber': 'urn:uuid:${const Uuid().v4()}',
-    if (Platform.environment['GITHUB_ACTIONS'] == 'true')
-      'version': int.parse(Platform.environment['GITHUB_RUN_ID']!),
+    'version': 1,
     'metadata': {
       'component': coreExtension.describeAsBomComponent(),
       'lifecycles': [
@@ -72,7 +77,7 @@ final class RustCrate {
 
   final List<RustCrate> dependencies = [];
 
-  String get bomRef => '$name-$version';
+  String get bomRef => '$name@$version';
 
   RustCrate({
     required this.name,
@@ -149,6 +154,10 @@ Future<List<RustCrate>> findDependencies() async {
     final license = match[4]!;
     final repository = match[5]!;
 
+    if (license.isEmpty) {
+      throw 'Crate $name@$version does not include a license expression.';
+    }
+
     // A crate is only fully expanded the first time it's encountered, so
     // later (deduped) occurrences reuse the same instance and its already
     // populated dependencies.