emit-sbom v1: implement SBOM dependency extraction from build.zig.zon

The v0 SBOM emitter (scripts/emit-sbom.zig) intentionally stubs dependency extraction: it refuses to publish an incomplete SBOM when the manifest declares .dependencies it cannot parse.

v1 scope:

Parse .dependencies entries from build.zig.zon (name, url/path, hash)
Emit them as CycloneDX components with pinned versions/hashes
Keep the refuse-to-publish guard for entries that fail to parse

Replaces the claude-zig-quality#TBD placeholders at scripts/emit-sbom.zig (refusal log + two TODOs).

Origin: CodeRabbit PR #1 review threads; parent plan Phase 5 decision item ("Decide whether scripts/emit-sbom.zig v1 TODOs are acceptable for this release or must become tracked issues").

🔗 Related PRs

EugOT/synthfq#5 - chore(toolchain): pin Zig 0.16.0 stable via mise [closed]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

fix(quality): R5 autofix on PR #1 — validated CodeRabbit 17-thread sweep

Navigation Menu

Repository navigation

emit-sbom v1: implement SBOM dependency extraction from build.zig.zon #3

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

emit-sbom v1: implement SBOM dependency extraction from build.zig.zon #3

Description

Activity

coderabbitai commented on Jun 12, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions