[afranken]

Description

• changelog for 5.2.3
• SBOM generation fix

Related Issue

N/A

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[Copilot]

Copilot review overview

🟡 Changes recommended

The SBOM workflow contains two unresolved critical issues.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Specify POST method for generate-report request · New
• Treat 202 responses as processing, not completed reports · New
• Use standard GitHub.com capitalization · New

What changed in this PR

This maintenance PR prepares the 5.2.3 release and updates asynchronous SBOM generation.

Changes:

• Adds 5.2.3 changelog entries.
• Replaces the deprecated SBOM action with GitHub API generation and artifact upload.

File	Summary
CHANGELOG.md	Adds 5.2.3 release notes; capitalize GitHub.com consistently (nit, 3 votes).
.github/​workflows/​sbom.yml	Adds asynchronous SBOM generation and upload; critical issues require using POST for report generation (1 vote) and not treating 202 Accepted as completion (3 votes).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The SBOM workflow currently uses GET for generate-report, preventing SBOM generation.

Review effort: Lite
Findings: None

Resolved since last review (3)

• Treat 202 responses as processing, not completed reports
• Specify POST method for generate-report request
• Use standard GitHub.com capitalization