The GitHub Actions job "CI" on grails-core.git/fix-overlapping-task-outputs has 
failed.
Run started by GitHub user ribafish (triggered by matrei).

Head commit for run:
ffbf8adb7398cadb31270f74d71e420a0e4a732a / Gasper Kojek <[email protected]>
Make SBOM timestamp reproducible to prevent cascading cache misses

The CycloneDX SBOM rewrite uses buildDate (which defaults to
Instant.now() without SOURCE_DATE_EPOCH) for the metadata timestamp.
This non-reproducible timestamp also changes the serialNumber UUID
(derived from JSON content). The SBOM is embedded in META-INF/sbom.json
inside every jar, so changed jars cascade cache misses through the
compile classpath of downstream projects.

Fix: use a fixed epoch (Instant.EPOCH) as the SBOM timestamp when
SOURCE_DATE_EPOCH is not set. The serialNumber UUID then also becomes
deterministic. Release builds with SOURCE_DATE_EPOCH continue to use
the real build date.

Report URL: https://github.com/apache/grails-core/actions/runs/23598440479

With regards,
GitHub Actions via GitBox

Reply via email to