ci: stop publishing packages and SBOMs to GitHub Packages by r-farkhutdinov · Pull Request #36234 · DevExpress/DevExtreme

r-farkhutdinov · 2026-11-10T15:20:08Z

Cherry-picks

ci: stop publishing packages and SBOMs to GitHub Packages #36260

Copilot

🟢 Approval recommended

No active review issues block the narrowed package publishing scope and removal of SBOM tooling.

No open issues 🎉

2 files not reviewed

packages/sbom/devextreme-extra-deps/pnpm-lock.yaml: Generated file
packages/sbom/pnpm-lock.yaml: Generated file

What changed in this PR

This PR narrows DevExtreme’s GitHub Packages publishing workflow to internal, artifacts, and monorepo-tools packages, and removes the repository’s software bill of materials (SBOM) tooling.

Changes:

Restricts the publishing matrix to four package filename patterns.
Removes SBOM generation, validation, artifact transfer, and publishing steps.
Deletes the isolated SBOM workspace and cleans up obsolete references.

File	Description
`tools/scripts/make-artifacts-package.ts`	Removes a commented-out SBOM copy operation.
`tools/scripts/common/paths.ts`	Removes the SBOM artifacts path constant.
`pnpm-workspace.yaml`	Removes the deleted SBOM workspace’s exclusion.
`packages/sbom/scripts/tsconfig.json`	Deletes SBOM script compiler settings.
`packages/sbom/scripts/make.ts`	Deletes the SBOM generation script.
`packages/sbom/scripts/add-workspace-hashes.ts`	Deletes internal-package hashing support.
`packages/sbom/README.md`	Removes SBOM setup and usage documentation.
`packages/sbom/project.json`	Deletes SBOM installation and generation targets.
`packages/sbom/pnpm-workspace.yaml`	Deletes isolated workspace settings and overrides.
`packages/sbom/pnpm-lock.yaml`	Removes the SBOM tooling lockfile.
`packages/sbom/package.json`	Deletes the SBOM package manifest.
`packages/sbom/devextreme-extra-deps/pnpm-workspace.yaml`	Removes the supplemental dependencies workspace.
`packages/sbom/devextreme-extra-deps/pnpm-lock.yaml`	Deletes its dependency lockfile.
`packages/sbom/devextreme-extra-deps/package.json`	Removes the supplemental CLDR dependency manifest.
`packages/sbom/.npmrc`	Deletes SBOM-specific registry configuration.
`.github/workflows/packages_publishing.yml`	Narrows package selection and removes all SBOM workflow steps.

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues were identified for the internal-package publishing restriction and SBOM infrastructure removal.

No open issues 🎉

2 files not reviewed

packages/sbom/devextreme-extra-deps/pnpm-lock.yaml: Generated file
packages/sbom/pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues are recorded for the change limiting publishing to the two internal packages and removing the SBOM pipeline.

No open issues 🎉

2 files not reviewed

packages/sbom/devextreme-extra-deps/pnpm-lock.yaml: Generated file
packages/sbom/pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues are recorded for the internal-package publishing and SBOM tooling changes.

No open issues 🎉

2 files not reviewed

packages/sbom/devextreme-extra-deps/pnpm-lock.yaml: Generated file
packages/sbom/pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues block approval of the publishing pipeline and SBOM tooling changes.

No open issues 🎉

2 files not reviewed

packages/sbom/devextreme-extra-deps/pnpm-lock.yaml: Generated file
packages/sbom/pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

…s.ts

Copilot

🔵 Needs a closer look

The release workflow now builds internal packages without a preceding public build, requiring clean CI validation of both internal tarballs because production builds and registry publishing cannot be exercised in this review environment.

No open issues 🎉

2 files not reviewed

packages/sbom/devextreme-extra-deps/pnpm-lock.yaml: Generated file
packages/sbom/pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

No active review issues are recorded for the changes narrowing publishing to internal DevExtreme packages and removing SBOM handling.

No open issues 🎉

_{Review effort: Balanced}

ci: stop publishing hub-built packages and SBOMs to GitHub Packages

097b17e

r-farkhutdinov self-assigned this Nov 10, 2026

r-farkhutdinov requested a review from a team as a code owner November 10, 2026 15:20

Copilot AI balanced review requested due to automatic review settings November 10, 2026 15:20

Copilot started reviewing on behalf of r-farkhutdinov November 10, 2026 15:20

View session

Copilot AI reviewed Nov 10, 2026

View reviewed changes

ci: publish only internal packages to GitHub Packages

eceaf3b

Copilot AI balanced review requested due to automatic review settings November 11, 2026 08:56

Copilot started reviewing on behalf of r-farkhutdinov November 11, 2026 08:56

View session

Copilot AI reviewed Nov 11, 2026

View reviewed changes

alexslavr reviewed Nov 11, 2026

View reviewed changes

Comment thread .github/workflows/packages_publishing.yml Resolved

r-farkhutdinov had a problem deploying to packages-publishing-daily November 11, 2026 13:00 — with GitHub Actions Failure

ci: build only internal packages for GitHub Packages publishing

addd7f8

Copilot AI balanced review requested due to automatic review settings November 11, 2026 13:21

Copilot started reviewing on behalf of r-farkhutdinov November 11, 2026 13:22

View session

Copilot AI reviewed Nov 11, 2026

View reviewed changes

r-farkhutdinov temporarily deployed to packages-publishing-daily November 11, 2026 13:26 — with GitHub Actions Inactive

ci: remove 25_2 from packages publishing scheduler

c50671d

Copilot AI balanced review requested due to automatic review settings November 11, 2026 14:26

Copilot started reviewing on behalf of r-farkhutdinov November 11, 2026 14:27

View session

Copilot AI reviewed Nov 11, 2026

View reviewed changes

ci: remove main from packages publishing scheduler

4940706

Copilot AI balanced review requested due to automatic review settings November 11, 2026 14:31

Copilot started reviewing on behalf of r-farkhutdinov November 11, 2026 14:31

View session

Copilot AI reviewed Nov 11, 2026

View reviewed changes

alexslavr previously approved these changes Nov 11, 2026

View reviewed changes

r-farkhutdinov changed the title ~~ci: stop publishing hub-built packages and SBOMs to GitHub Packages~~ ci: stop publishing packages and SBOMs to GitHub Packages Nov 11, 2026

IlyaKhD reviewed Nov 11, 2026

View reviewed changes

Comment thread .github/workflows/packages_publishing.yml Resolved

IlyaKhD reviewed Nov 11, 2026

View reviewed changes

Comment thread tools/scripts/common/paths.ts Resolved

ci: rename internal packages build target and restore newline in path…

473a66d

…s.ts

r-farkhutdinov dismissed alexslavr’s stale review via 473a66d November 12, 2026 08:05

Copilot AI balanced review requested due to automatic review settings November 12, 2026 08:05

Copilot started reviewing on behalf of r-farkhutdinov November 12, 2026 08:06

View session

Copilot AI reviewed Nov 12, 2026

View reviewed changes

IlyaKhD previously approved these changes Nov 12, 2026

View reviewed changes

r-farkhutdinov mentioned this pull request Nov 12, 2026

ci: stop publishing packages and SBOMs to GitHub Packages #36260

Merged

r-farkhutdinov added this pull request to the merge queue Nov 12, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Nov 12, 2026

r-farkhutdinov added this pull request to the merge queue Nov 13, 2026

r-farkhutdinov removed this pull request from the merge queue due to a manual request Nov 13, 2026

ci: restore SBOM package

e3cf506

r-farkhutdinov dismissed IlyaKhD’s stale review via e3cf506 November 13, 2026 08:23

Copilot AI balanced review requested due to automatic review settings November 13, 2026 08:23

Copilot started reviewing on behalf of r-farkhutdinov November 13, 2026 08:23

View session

Copilot AI reviewed Nov 13, 2026

View reviewed changes

Navigation Menu

Repository navigation

ci: stop publishing packages and SBOMs to GitHub Packages - #36234

ci: stop publishing packages and SBOMs to GitHub Packages#36234
r-farkhutdinov wants to merge 7 commits into
mainfrom
r-farkhutdinov/disable-ghp-publication

r-farkhutdinov commented Nov 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

r-farkhutdinov commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cherry-picks

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

r-farkhutdinov commented Nov 10, 2026 •

edited

Loading