# Changelog

## Score

- CAI 40 → 40 (-0.7)

## Lenses

- Code Health 77 → 77 (-0.4)
- Architecture 75 → 75 (+0.0)
- Maturity 60 → 65 (+5.0)
- Readiness 67 → 58 (-9.1)
- Security 88 → 94 (+6.3)
- Event-Driven 10 → 10 (+0.0)

## Resolved (3)

- Duplicated block (13 lines × 2) (src/oci/ocibuild_sbom.erl)
- No SBOM
- PR-triggered workflow grants a write-scoped token

## New (4)

- Duplicated block (5 lines × 2) (src/adapters/ocibuild_release.erl)
- PR-triggered workflow grants a write-scoped token (.github/workflows/ci.yaml)
- TooManyFunctions: ocibuild_sbom (src/oci/ocibuild_sbom.erl)
- ocibuild_release.app_dependency_names (cognitive 21) (src/adapters/ocibuild_release.erl)

## Changes since last survey

- 23 commits — 14 feature/other, 9 fixes

## By area

- src/adapters — 7 commits
- (root) — 6 commits
- src/oci — 6 commits
- .github/workflows — 2 commits
- lib/ocibuild — 2 commits

## Notable commits

- fix: fix(ci): pin the docs build to ubuntu-24.04 (#75)
- fix: fix(ci): verify the image signature by commit SHA tag (#74)
- fix: fix: add mandatory SPDX 2.2 package fields to SBOM (#58)
- fix: fix: attach ERTS and the base image to the SBOM dependency tree (#70)
- fix: fix: follow the purl spec for the base image oci purl (#78)
- fix: fix: keep SPDX IDs unique when package names collide (#77)
- fix: fix: only list shipped dependencies in the SBOM (#61)
- fix: fix: split ENTRYPOINT and CMD for container orchestrator compatibility (#67)
- fix: fix: use Hex tarball and git+ URLs for SBOM downloadLocation (#71)
- change: ci: make the NTIA minimum elements check blocking (#83)
- change: ci: validate generated SBOMs with spdx-tools and the NTIA checker (#69)
- change: docs: merge CLAUDE.md into AGENTS.md (#63)
- change: feat: describe OTP and Elixir applications in the SBOM (#84)
- change: feat: emit SPDX 2.3 SBOMs (#59)
- change: feat: emit package checksums in the SBOM (#79)
- change: feat: emit the dependency graph in the SBOM (#64)
- change: feat: list OTP and Elixir applications in the SBOM (#85)
- change: feat: report the Hex outer checksum from the Mix adapter (#80)
- change: feat: report the Hex outer checksum from the rebar3 adapter (#81)
- change: feat: report the dependency graph for rebar3 releases (#68)
- …and 3 more