Wire a software bill of materials or license report into the build
A per-build inventory of what shipped, produced as an artefact rather than reconstructed later.
The ticket
Produce a software bill of materials or license report as part of the build.
Acceptance criteria
- The report is generated on every build and stored as an artefact
- It covers transitive dependencies, not only direct ones
- Its format is one downstream tooling can consume
- Build time impact is recorded
What lands as proof
A generated report attached to a real build, covering the full transitive tree.
Why teams defer it
- It is a compliance artefact, so it only becomes urgent when somebody outside engineering asks for it.
- It edits pipeline files, which stops the run for a human to approve.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: produce a software bill of materials or license report as part of the build. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means approved on the plan, report produced as a build artefact, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops for the plan, and the review bar is raised afterwards so that smaller suggestions block the merge too, not only serious findings.