Docs: Add interim evaluation and dev plan

[ModeSevenIndustrialSolutions]

Break-point review of the repository against docs/BRIEF.md, taken after
PR #38 (Go build_type for the CLM lane, v0.3.0) merged, written out as
docs/INTERIM_EVALUATION.md.

What it contains

• Course check: the BRIEF's strategy holds; two corrections are
  recorded — inline shell accumulating in the CLM lane, and the missing
  build↔scan artefact interface as the structural gap.
• Open issue inventory: all seven open issues (Verify Nexus IQ ingestion of syft-generated CycloneDX SBOMs #39, Generalise the Nexus IQ SBOM upload path beyond Go #40, Adopt go.list as the Go scan target for the Sonatype Lifecycle lane #41, Add a Python build_type to the Sonatype Lifecycle lane #42,
  Use build-metadata-action for Go version detection in both scan lanes #43, Correct the Node.js CLM caller claim in docs/BRIEF.md #44, Gerrit example and migration guidance for the Go CLM path #50) with their post-Feat: Add a Go build_type to the Sonatype Lifecycle lane #38 remaining scope (the merged PR
  absorbed the scan_mode rename from Generalise the Nexus IQ SBOM upload path beyond Go #40, the CLM half of Use build-metadata-action for Go version detection in both scan lanes #43, and
  the scan_mode/build_type validation guard), grouped into three
  clusters with dependency ordering.
• Estate research findings: sbom-action / python-sbom-action
  fitness for the Nexus IQ REST upload path, build-metadata-action
  output coverage, the missing Python dependency-resolution primitive,
  and the artefact-transport gap — including the
  docker-save-images-action v0.2.0 archive modes and the in-flight
  grype-scan-action (PR Feat: Implement the Grype scan action grype-scan-action#1) as
  design inputs, with a borrow-not-share rule for reuse across action
  repositories.
• A four-phase development plan:
  1. Unblock and de-risk — Correct the Node.js CLM caller claim in docs/BRIEF.md #44, the Verify Nexus IQ ingestion of syft-generated CycloneDX SBOMs #39 syft ingestion spike, the Gerrit example and migration guidance for the Go CLM path #50
     policy-opa-pdp parity migration, and Use build-metadata-action for Go version detection in both scan lanes #43's remaining Sonar-lane
     half
  2. Consolidate the SBOM transport (Generalise the Nexus IQ SBOM upload path beyond Go #40), extracting the Nexus IQ REST
     upload into a composite action
  3. Better defaults and new ecosystems (Adopt go.list as the Go scan target for the Sonatype Lifecycle lane #41, Add a Python build_type to the Sonatype Lifecycle lane #42)
  4. A new build-artifact-action pack/unpack pair and its CLM lane
     integration
• Deployment sequencing for ONAP, O-RAN-SC and OpenDaylight, and a
  risks/open-decisions register.

Also extends the write-good pre-commit exclusion to the new document,
matching the existing BRIEF.md exemption for design-decisions records.

Documentation only; no workflow changes.

[Copilot]

Pull request overview

Adds an interim assessment and phased development plan following the v0.3.0 Go CLM work.

Changes:

• Inventories remaining issues and dependencies.
• Documents supporting-action research and architectural gaps.
• Proposes four implementation and deployment phases.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (6)

docs/INTERIM_EVALUATION.md:412

• The current Gather build metadata step runs only for Maven, Gradle, or Go. Under the proposed Python path (build_type: 'none'), it is skipped, leaving project_type empty and routing the project to syft instead of python-sbom-action. Make broadening that condition an explicit Phase 2 task.

   Phase 3 — so derive it from the `Gather build metadata` step's
   `project_type`: Python projects route to `python-sbom-action`,
   everything else to `sbom-action` (syft). That gives Python
   projects SBOM-mode coverage via `build_type: 'none'` in this

docs/INTERIM_EVALUATION.md:411

• project_type is singular, so it cannot reliably select the Python generator for polyglot repositories. At v0.8.0, a repository containing both package.json and pyproject.toml is classified as javascript-npm because JavaScript has higher detector priority; its Python dependencies then bypass python-sbom-action. Define an explicit override or multi-ecosystem behavior rather than treating this output as an ecosystem inventory.

   Phase 3 — so derive it from the `Gather build metadata` step's
   `project_type`: Python projects route to `python-sbom-action`,
   everything else to `sbom-action` (syft). That gives Python

docs/INTERIM_EVALUATION.md:158

• go_version_file is also a shipped explicit input. If metadata fills whenever go_version is empty, a caller that selects a non-default version file will be silently overridden. Preserve the precedence go_version → non-default go_version_file → metadata during deprecation.

This issue also appears in the following locations of the same file:

• line 409
• line 409

  independently. Those inputs have shipped, so the change is
  deprecate-and-default: explicit input wins, `build-metadata-action`
  fills when empty — mirroring `java_version`. Removal can ride the
  next minor bump under pre-1.0 versioning.

docs/INTERIM_EVALUATION.md:289

• actions/download-artifact ignores pattern when name is supplied, so this interface cannot provide both artifact-name and pattern-based fan-in as independent passthroughs. Define them as mutually exclusive and only accept merge-multiple with pattern.

- **unpack:** `artifact-name`, destination `path`, optional
  `pattern`/`merge-multiple` passthrough for matrix fan-in, the same

docs/INTERIM_EVALUATION.md:310

• A caller cannot access the workspace of a completed reusable build workflow or insert a packing step into its jobs. Adding only the CLM unpack path therefore supports same-job *-build-action callers, not “any build workflow”; the producer workflows must also pack and publish the artifact before their jobs end.

1. `sonatype-lifecycle.yaml` gains an `artifact_name` input as an
   alternative to `build_type`: a caller that already ran
   `maven-build-action` (or any build workflow) hands the resolved
   workspace to the scan job instead of building twice. This is the
   direct answer to "CLM jobs need to interface with build jobs"
   without nesting workflows, and it composes at the caller —

docs/INTERIM_EVALUATION.md:125

• The PR description still lists the scan_mode validation-trap fix as Phase 1 work, while this updated plan correctly records it as already shipped in PR #38. Update the PR description so its phase summary matches this document.

One item in #40's status comment — the `scan_mode: 'sbom'` plus
non-Go `build_type` validation trap — was **fixed in PR #38's final
form**: the shipped `validate` job rejects the combination loudly,
with an in-file note to remove the restriction once #40 generalises
`sbom` beyond Go. Recorded here as done; no Phase 1 work remains for

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/INTERIM_EVALUATION.md:413

• The proposed Python route is unreachable as written. Gather build metadata currently runs only for Maven, Gradle, or Go (.github/workflows/sonatype-lifecycle.yaml:555), so build_type: 'none' leaves project_type empty and sends Python through the “everything else” syft path. Make broadening that step's condition part of Phase 2.

   Phase 3 — so derive it from the `Gather build metadata` step's
   `project_type`: Python projects route to `python-sbom-action`,
   everything else to `sbom-action` (syft). That gives Python
   projects SBOM-mode coverage via `build_type: 'none'` in this
   phase, without preempting the Phase 3 CLI decision.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/INTERIM_EVALUATION.md:435

• The proposed default can silently choose the wrong generator for an explicit Maven, Gradle, or Go caller. build-metadata-action v0.8.0 checks pyproject.toml before pom.xml, build.gradle, and go.mod, so a polyglot build_type: 'maven' checkout can route to python-sbom-action and omit its Java dependencies. Give the explicit override first precedence, map non-none shipped build types to syft, and consult project_type only for build_type: 'none'.

   Phase 3 — so derive it from the `Gather build metadata` step's
   `project_type`: Python projects route to `python-sbom-action`,
   everything else to `sbom-action` (syft). Two consequences are

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

docs/INTERIM_EVALUATION.md:84

• The inventory assigns #42 to Cluster C, but Cluster C is explicitly limited to #43/#44, while #42 is discussed under Cluster A and Phase 3. Classify it consistently so the dependency grouping is actionable.

| #42 | Python `build_type` for the CLM lane             | Full — CLI path with dependency resolution                                                                | A/C     |

docs/INTERIM_EVALUATION.md:473

• This example contradicts the same-job constraint at lines 316–320: a caller cannot pack the workspace of a completed reusable build workflow unless that workflow first gains the deferred publish step. Describe a producer job here, or add the workflow-repository changes to Phase 4.

   `sonatype-lifecycle.yaml`, with a caller example showing
   build-workflow → CLM-lane composition. `build_type` defaults to

docs/INTERIM_EVALUATION.md:527

• docker-save-images-action has already published v0.2.0, as recorded at line 246, so it cannot still be waiting for its “first tag.” Keep the release gate only for the untagged Grype action and name v0.2.0 as the Docker interface to re-check.

  do not couple to unreleased pins, and re-check both at their first
  tags before Phase 2/4 code review. Any temptation to share code

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

docs/INTERIM_EVALUATION.md:494

• The Docker load side is not a valid prototype for download-artifact + tar: its downloaded tar is the Docker image archive consumed by docker load, not an outer build archive to extract. Use the CLM artifact path for this prototype, or prototype a Docker-specific download/load action separately.

A cheap intermediate step worth considering before the new action
exists: `mode: unpack` semantics can be prototyped as a raw
`download-artifact` + `tar` step pair in one consumer (e.g. the
docker-workflows load side or a CLM `artifact_name` spike), proving

docs/INTERIM_EVALUATION.md:324

• mode: unpack cannot retire Docker's load side: a Docker image archive must remain intact and be imported with docker load; extracting that tar only exposes its layer/manifest files and does not populate the daemon. Keep a Docker-specific download/load counterpart, or add an explicit Docker-load mode rather than treating generic unpack as the replacement.

This issue also appears on line 491 of the same file.

3. Eventually, a `mode: unpack` sibling usage retires the missing
   `docker load` counterpart in `docker-workflows`.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

docs/INTERIM_EVALUATION.md:478

• This integration cannot satisfy the unpack design's newly-created-empty-root requirement as written: the current lane always checks out into the workspace first (.github/workflows/sonatype-lifecycle.yaml:527-547). Make the artifact branch skip both checkout paths and restore directly into a fresh path_prefix; otherwise extraction either violates the safety invariant or overlays an independently checked-out tree.

2. Add the optional `artifact_name` consumption path to
   `sonatype-lifecycle.yaml`, with a caller example showing a
   **producer job** (running `maven-build-action` or similar, then
   packing and uploading before the job ends) composed with the CLM
   lane. `build_type` defaults to

docs/INTERIM_EVALUATION.md:497

• Do not prototype this input with a raw tar extraction. The CLM job holds Nexus IQ credentials and accepts an artifact produced by another job, so a crafted archive can exploit traversal or link entries before the production validator exists. Any spike must apply the same member/link checks and fresh-empty-root requirement defined above, preferably through the unpack helper/action.

A cheap intermediate step worth considering before the new action
exists: `mode: unpack` semantics can be prototyped as a raw
`download-artifact` + `tar` step pair in the CLM `artifact_name`
spike, proving

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/INTERIM_EVALUATION.md:325

• The estate has sbom-files upload/download hops in five workflow repositories, not four: Go, Node.js, Python, Java, and Docker. Docker's load path is correctly excluded below, but its separate SBOM hand-off is still an instance of this second item. Update the count (or explicitly name the four intended repositories if Docker's SBOM hop is deliberately excluded).

2. The `sbom-files` hop in the four `*-workflows` repositories,
   replacing repeated raw pairs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

docs/INTERIM_EVALUATION.md:83

• The #40 row still lists “fix the validation trap” as remaining work, but lines 121–126 explicitly record that PR #38 already fixed it. Remove that phrase so the inventory does not reintroduce the completed P1 item.

| #40 | Generalise the SBOM upload path                  | Partial — swap in `sbom-action`, extend beyond Go, retire `go_sbom_tool_version`, fix the validation trap | A       |

docs/INTERIM_EVALUATION.md:485

• path_prefix currently defaults to '.' (sonatype-lifecycle.yaml:70-74), which is an already-existing workspace directory and cannot satisfy the newly-created-empty-root invariant. As written, an artifact_name caller that keeps the default has no valid extraction destination. Require a non-default path or derive a dedicated effective subdirectory for artifact mode and use it consistently downstream.

   lane. The artifact branch must **skip both checkout paths** and
   restore into a fresh `path_prefix`, or extraction would either
   violate the unpack design's newly-created-empty-root invariant
   or overlay an independently checked-out tree. `build_type`

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/INTERIM_EVALUATION.md:558

• This status is already stale: grype-scan-action PR #1 merged on 2026-08-20 and v0.0.1 was published at 07:59 UTC. Update the dated snapshot and the earlier “in flight” description, then record the promised first-tag interface check instead of leaving Phase 2 gated on an event that has already happened.

  do not couple to unreleased pins. grype-scan-action is untagged,
  so re-check it at its first tag before Phase 2 code review;

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.