fix(wizard): prefer is_default_workspace, keep reading the old name

[aurangzaib048]

The backend is renaming is_default_team. It now serves is_default_workspace beside it, both carrying the same value, with the old one deprecated. This is the action's half, and it wants to land before any sunset date.

Why this one matters more than a normal field rename

The wizard's workspace picker reads that flag to mirror how the backend scopes list_products / list_components:

if member.get("is_me") and member.get("is_default_team"):
    return key
return fallback

When the field is dropped, .get() returns None. Not an exception, not a 4xx: every membership reads False, the loop falls through, and fallback is the first workspace in the list. A user with several workspaces silently gets the wrong one, and uploads land in it.

The auth-success status line names the picked workspace, so a human can currently spot a mismatch. After the drop, that line would confidently name the wrong workspace with nothing looking broken.

Reading only the new name has the opposite problem: it breaks against any backend that has not shipped it yet, including self-hosted installs on an older release. So _is_default_member prefers the new name and falls back to the old.

Tests

Four cases: both names present, the old one alone, the new one alone, and the two disagreeing.

The sunset case is the one worth having. Point the picker back at the old field and it fails exactly as the outage would look:

assert _pick_default_workspace_key(workspaces) == "sandbox"
E  AssertionError: assert 'prod' == 'sandbox'

Wrong workspace, no error.

Note

tests/test_php_composer.py::TestWhenItIsFetched::test_other_ecosystems_do_not[go.mod] fails on this branch and on its parent commit. Pre-existing and unrelated to this change.

[Copilot]

Pull request overview

This PR updates the wizard’s workspace default-selection logic to stay compatible with a backend rename from is_default_team to is_default_workspace, ensuring the wizard continues to pick the correct default workspace across both new and old backend versions.

Changes:

• Prefer is_default_workspace when selecting the default workspace, while falling back to deprecated is_default_team.
• Add test coverage for the four compatibility cases (both fields present, old-only, new-only, and disagreement).
• Add an audit_trail.txt file to the repo (appears to be a generated artifact and unrelated to the field rename).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
sbomify_action/cli/wizard/screens/authenticate.py	Adds _is_default_member helper and updates default-workspace selection to prefer the new backend flag with backward compatibility.
tests/test_wizard_state.py	Adds tests covering backward/forward compatibility and the sunset scenario for the renamed backend flag.
audit_trail.txt	New audit trail output file added at repo root (appears to be a generated runtime artifact, not part of the wizard rename fix).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The behavioral change is small, well-scoped, and backed by targeted tests, with only a minor docstring clarity nit noted.

Review details

Suppressed comments (1)

sbomify_action/cli/wizard/screens/authenticate.py:35

• Docstring caveat still refers to the deprecated flag name (is_default_team=False), even though the function now prefers is_default_workspace. Updating the example to mention the new name (and optionally the legacy name) would avoid confusion once the old field is sunset.

    Caveat: for a *scoped* token bound to a non-default workspace, the
    membership block on the token's bound workspace still reads
    ``is_default_team=False`` (the flag tracks the user's default, not

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite