Skip to content

fix: require a collection for every release (#286) - #306

Merged
oej merged 2 commits into
CycloneDX:mainfrom
Mehrn0ush:fix/release-always-has-collection
Sep 18, 2026
Merged

oej merged 2 commits into
CycloneDX:mainfrom
Mehrn0ush:fix/release-always-has-collection

Conversation

@Mehrn0ush

Copy link
Copy Markdown
Contributor

Summary

  • Every component/product release has a TEA Collection (may be empty `artifacts: []`)
  • Empty first version uses `INITIAL_RELEASE`; first artifacts publish as version 2
  • Make `artifacts` required on `collection`; `latestCollection` stays required
  • `/collection/latest` `404` means the release is unknown
  • Align collection docs: `createdDate`, `COMPONENT_RELEASE` / `PRODUCT_RELEASE`

Test plan

  • Skim README, tea-requirements, tea-collection.md, OpenAPI `collection` + both `/collection/latest`

Thanks @taleodor

Closes #286

Document that releases always have a collection (empty v1 allowed),
require artifacts on the collection schema, and clarify /collection/latest 404. Thanks @taleodor

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>

@taleodor taleodor left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two edits and this is good. (1) The component-release-with-collection example is now inconsistent with the rule: version: 2 with INITIAL_RELEASE and artifacts. Make it version: 1, or keep 2 and use ARTIFACT_ADDED. (2) In tea-collection.md, replace the quoted "version 1 is whatever was first observable" line with plain prose, e.g. "In both cases version 1 is the first collection a client could have retrieved." While in that list, the empty bullet above artifacts can go.

Also, Line 333 is a stray empty bullet ( -) between updateReason and artifacts. Pre-existing, but the list is being edited in this PR, so pls correct.

Use ARTIFACT_ADDED for the version-2 example with artifacts, replace the
quoted version-1 line with plain prose, and drop the stray empty bullet.

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
@Mehrn0ush

Copy link
Copy Markdown
Contributor Author

Thanks.
Fixed both: example now uses ARTIFACT_ADDED at version 2 with artifacts; tea-collection.md uses the plain "first collection a client could have retrieved" wording and drops the empty bullet.

@oej
oej merged commit 99526fc into CycloneDX:main Sep 18, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Release without a collection — optional latestCollection or always require one?

3 participants