The pipeline leaves repository_version empty, but tags the Dependency-Track
upload with the commit it scanned. Use that when no version is stated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report now covers every finding from all tools, so "SAST/SCA Report"
undersold it. The report and artifact ids were never filled in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>