|
Rewrite the design around one decision: how to make webui-vue build
offline and report per-dependency licenses using Yocto-native
mechanisms.
Recommend teaching autobump to generate per-component Yocto recipes
from package-lock.json (a webui-vue-specific special case that
changes no other recipe's build). Every npm dependency then fetches
like any other recipe, and the image SBOM comes for free via
per-recipe LICENSE and create-spdx. The webui-vue recipe is
rewritten to DEPENDS on those recipes and build Vite offline;
there is no separate pre-fetch step.
Demote pre-built dist and ad-hoc npm pre-fetch to rejected/deferred
alternatives, and abandon the repo-root CycloneDX/git-hook approach
(91792). Incorporate maintainer review feedback: shorter and
decision-focused, with no inlined recipe files.
Change-Id: I7d73812cc91079080af80f22cba49cf19279b839
Signed-off-by: Jason Westover <jwestover@nvidia.com>
|
