Ramon Roche 7e6ccb3eb6 ci(sbom): check out submodules recursively in PR license check ...

The PR-time SBOM license check was using `submodules: false`, so when
generate_sbom.py ran the new submodule directory was empty. The script
treats uninitialized submodules as `(not checked out) -> NOASSERTION
(skipped)` rather than a failure, which let PR #27184 (adding
PX4-OpticalFlow as a submodule) pass without ever inspecting the actual
repo for a LICENSE file. The monthly audit then caught it (#27217)
because it uses `submodules: recursive`.

Switch the PR-time job to `submodules: recursive` so license issues
are caught at PR time rather than on the next monthly audit. The job
only runs when .gitmodules, license-overrides.yaml, or
generate_sbom.py change, so the extra clone cost is bounded.

Signed-off-by: Ramon Roche <mrpollo@gmail.com>

2026-04-27 11:37:46 -06:00

..

actions

ci(workflows): bump all action versions to latest majors

2026-04-10 07:30:50 -06:00

instructions

ci(claude): add review-pr skill for domain-aware PR reviews (#26814)

2026-04-01 17:56:23 -07:00

ISSUE_TEMPLATE

fix(labels): rename documentation label (#27187)

2026-04-24 09:17:05 -08:00

workflows

ci(sbom): check out submodules recursively in PR license check

2026-04-27 11:37:46 -06:00

fuzzing_issue_template.md

…

labeler.yml

fix(labels): rename documentation label (#27187)

2026-04-24 09:17:05 -08:00

PULL_REQUEST_TEMPLATE.md

…

runs-on.yml

…