[drkjc]

Changes

• publish.yml: give the SBOM's root component the package's purl, since cyclonedx-py leaves it out
• README.md: point the Client SDK links to @spreedly/composer-sdk-client
• Bump the version to 1.0.1, and add the 1.0.1 entry to CHANGELOG.md

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[datadog-spreedly]

⚠️ Warnings

Your PR has warnings. Please review the issues below.

🚦 1 Pipeline job failed

Copilot | copilot-pull-request-reviewer

View in Datadog · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 6b76865 | Docs | View more details | Give us feedback!}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Samy-O7]

Approving at 6b76865. Checked by running the publish workflow's steps locally with Python 3.13.9 on a local merge of this PR into main, which has the same tree as this PR:

• The check passes for a v1.0.1 tag and writes the 1.0.1 section as the release notes. A v1.0.0 tag fails.
• The wheel and sdist have the same files as the published 1.0.0 (15 and 35 entries), and the only code change is SDK_VERSION.
• pip-audit finds no known vulnerabilities. The SBOM is valid CycloneDX 1.6, and its root now has pkg:pypi/spreedly-composer-sdk-server@1.0.1, which is the only change from 1.0.0's SBOM. The root still isn't repeated in components, and the five runtime components are the same.
• gitleaks 8.30.1 finds nothing in the extracted wheel and sdist.