fix(release): SBOM step conflicts with .[all] extras — install base only

[alphacrack]

What

One-line change to .github/workflows/publish-pypi.yml: the SBOM step now runs pip install -e "." instead of pip install -e ".[all]".

Why

The v0.5.0 publish attempt failed at the SBOM step:

ModuleNotFoundError: No module named 'cyclonedx.builder'
  File ".../cyclonedx_py/_internal/utils/cdx.py", line 27
    from cyclonedx.builder.this import this_component as lib_component

Chain of events:

1. pip install build twine cyclonedx-bom installs cyclonedx-python-lib==11.11.0 (dep of cyclonedx-bom v7).
2. pip install -e ".[all]" pulls in checkov, which pins cyclonedx-python-lib>=5,<8. pip downgrades the lib to 7.6.2.
3. cyclonedx-py environment then crashes because cyclonedx.builder was removed between lib 8 and 11.

This has silently broken every release since v0.4.0 (April 2026). Confirmed by re-inspecting run 24622455355 — same fingerprint.

Why this fix over alternatives

• Reinstall cyclonedx-bom AFTER .[all] — doesn't help: checkov's <8 pin blocks lib>=8, and cyclonedx-bom v7 requires >=8. Hard conflict, not resolver order.
• Isolated venv for cyclonedx-py — works but adds ~6 lines of orchestration.
• Install base only ← this PR. SBOM describes what pip install iac-scanner gives an end user; optional extras have their own dep trees. Cleanest.

What lands in the SBOM

Before this PR: + + + +

   _               _

| | ___ | | _______ __
/ _| ' \ / _ / | |/ / _ \ \ / /
| (| | | | / (| < () \ V /
_|| ||_|_||____/ _/

By Prisma Cloud | version: 3.2.524
Update available 3.2.524 -> 3.3.8
Run pip3 install -U checkov to update + + (everything from ).

After this PR: + + + (default install). Users who install iac-scanner[rules] etc. get the checkov dep tree in their own env; if they need an SBOM for that superset they should generate it locally.

Verified

Ran the exact CI sequence locally on Python 3.12:

$ pip install build twine 'cyclonedx-bom>=4.0.0'
$ pip install -e "."
$ cyclonedx-py environment --output-format json --output-file /tmp/sbom.cdx.json
$ python -c "import json; d=json.load(open('/tmp/sbom.cdx.json')); print(d['bomFormat'], d['specVersion'], 'components:', len(d['components']))"
CycloneDX 1.6 components: 12

Under the .[all] version this raised ModuleNotFoundError.

Next steps

Once merged, I will:

1. Delete GitHub Release + tag v0.5.0 (nothing was published anywhere yet — safe).
2. Re-tag v0.5.0 on the new main tip (now with this fix reachable).
3. Push tag → release.yml re-creates the Release → I manually dispatch publish-pypi.yml on v0.5.0.
4. Publish job pauses at release env for @alphacrack approval → PyPI upload + Sigstore + SBOM attached to Release.

Related

• Blocks v0.5.0 release
• Explains why v0.4.0 release also failed to attach SBOM

Checklist

• Change is scoped to one workflow step
• Local repro of the failure and of the fix
• DCO sign-off
• No CHANGELOG entry needed (release infra hotfix, invisible to end users of a shipped release)