Add `*Craft.yaml` relative path to `Approved` *Craft `response-inspection`
Metadata
Current evaluation
Approved Craft inspections still omit the matched metadata YAML path. A maintainer agreed to add it as a first-class field, but implementation remains outstanding.
Suggested action: keep open
Reason: Maintainer @cmatsuoka agreed that the YAML location relative to the project root can be added, and the reporter confirmed that approach is sufficient. The current Craft code finds candidates such as snap/snapcraft.yaml but passes only standard artifact metadata to SetResponseApproved, confirming the requested first-class path field is still absent; the exact field naming and the reporter's final question about downloads remain unanswered.
Evaluated by: mr-cal-bot
Impact:
52
Quick Win:
23
Complexity:
44
Confidence:
91
Actionability:
79
Issue body
### What needs to get done
Currently, when *Craft inspection is approved, it only shares that the *craft repository was found:
```json
"response-inspection": {
"craft.rockcraft": {
"opinion": "Unknown",
"reason": "git repository does not contain a rockcraft.yaml file"
},
"craft.snapcraft": {
"opinion": "Approved",
"reason": "snapcraft repository found",
"annotations": {
"checkout": "e684f4cd695f9c9e835dd5d5cbb109d3761753a6"
}
```
It would be nice to have the relative path of where this file was found.
### Why it needs to get done
This information would help enrich the SBOM with a specifier for the metafile of the package, something like:
`PackageDownloadLocation: git+https://git.myproject.org/MyProject@e684f4cd695f9c9e835dd5d5cbb109d3761753a6#/snapcraft/snapcraft.yaml`
Doing this on the SBOM Generator side is not feasible as it might not have access to all the repositories, so traversing after cloning is not an option for the sbom generator.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
52
Quick Win:
23
Complexity:
44
Confidence:
91
Actionability:
79
|
keep open | Approved Craft inspections still omit the matched metadata YAML path. A maintainer agreed to add it as a first-class field, but implementation remains outstanding. | |
| stealth/space-bunny-alpha |
Impact:
56
Quick Win:
23
Complexity:
45
Confidence:
88
Actionability:
74
|
keep open | Add a machine-readable relative path for matched Craft metadata YAML to Approved inspections. The maintainer agreed this is feasible; implementation and field design remain outstanding. | |
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
28
Staleness:
75
Complexity:
30
Confidence:
60
Support Request:
10
|
close stale | Feature request to add *Craft.yaml relative path to response-inspection output. Acknowledged by maintainer but inactive for 390 days with an unanswered follow-up question. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.