fix: v0.3.3 SBOM generation - #150
Conversation
|
Warning Review limit reached
Next review available in: 50 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe publish workflow replaces ChangesProduction SBOM generation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant PublishWorkflow
participant CycloneDX
participant SBOMValidator
PublishWorkflow->>PublishWorkflow: Create production-only lockfile
PublishWorkflow->>CycloneDX: Generate SBOM with lockfile and workspace exclusion
CycloneDX-->>PublishWorkflow: Write sbom.cdx.json and validation log
PublishWorkflow->>SBOMValidator: Validate BOM and root dependency coverage
SBOMValidator-->>PublishWorkflow: Confirm validation and dependency matches
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 442-446: Update the SBOM generation command around
--ignore-npm-errors and --validate to fail closed: remove or replace the option
that suppresses npm resolution errors, and enforce a non-zero exit when
CycloneDX cannot perform validation or validation fails. Preserve the existing
package-lock-only, dev omission, and workspace settings.
- Around line 441-447: Update the CycloneDX invocation in the SBOM generation
step to use a committed, reviewed toolchain lockfile, or otherwise verify the
exact package tarball and all dependency integrities before executing
cyclonedx-npm. Preserve the existing SBOM options and ensure the locked
verification covers `@cyclonedx/cyclonedx-npm`, `@cyclonedx/cyclonedx-library`,
commander, and transitive dependencies.
In `@tests/trust-floor/publish-deps.test.ts`:
- Around line 261-267: Update the error message in the publish workflow
assertion to include the same --ignore-scripts option required by the
workflow.includes check. Keep the suggested command otherwise unchanged so the
failure guidance exactly matches the asserted command.
- Around line 270-284: Scope the required-argument checks in the publish
workflow test to the cyclonedx-npm command within the “Generate SBOM” step
instead of the entire workflow, while preserving the exact pinned invocation
assertion. Add a negative fixture/test case that removes one required flag and
verifies the validation fails, covering the error path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7eea57d4-256f-409f-ae49-247a62f8e578
📒 Files selected for processing (2)
.github/workflows/publish.ymltests/trust-floor/publish-deps.test.ts
| if (!workflow.includes("npx --yes --package=@cyclonedx/cyclonedx-npm@4.2.1 -- cyclonedx-npm")) { | ||
| throw new Error( | ||
| "Publish workflow should generate the SBOM with `npm sbom --sbom-format cyclonedx --package-lock-only --workspaces=false` from the unpacked tarball. Next: update .github/workflows/publish.yml to use npm sbom in the isolated temp dir.", | ||
| "Publish workflow should use an exactly pinned CycloneDX npm generator. Next: restore the pinned @cyclonedx/cyclonedx-npm invocation in .github/workflows/publish.yml.", | ||
| ); | ||
| } | ||
|
|
||
| for (const requiredArgument of [ | ||
| "--ignore-npm-errors", | ||
| "--package-lock-only", | ||
| "--omit dev", | ||
| "--no-workspaces", | ||
| "--validate", | ||
| '--output-file "$GITHUB_WORKSPACE/sbom.cdx.json"', | ||
| ]) { | ||
| if (!workflow.includes(requiredArgument)) { |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Scope the argument assertions to the CycloneDX command.
The loop calls workflow.includes(requiredArgument) on the entire workflow. --package-lock-only already appears in the different npm install command at Line 262, so removing it from the CycloneDX invocation at Line 443 would still pass this test. Parse the Generate SBOM step, extract its cyclonedx-npm command, and check every required argument against that command. Add a negative fixture that removes one flag.
As per path instructions, tests/**/*.ts requires coverage of error paths, not only the happy path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/trust-floor/publish-deps.test.ts` around lines 270 - 284, Scope the
required-argument checks in the publish workflow test to the cyclonedx-npm
command within the “Generate SBOM” step instead of the entire workflow, while
preserving the exact pinned invocation assertion. Add a negative fixture/test
case that removes one required flag and verifies the validation fails, covering
the error path.
Source: Path instructions
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 454-456: Update the workflow step around TMPDIR and tar extraction
to pass steps.pack.outputs.tarball through the step’s env configuration, then
reference that environment variable in the tar command instead of interpolating
the expression directly in the run script.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b84fffdc-098a-4ef1-bd5c-a917dd446ba3
⛔ Files ignored due to path filters (2)
.github/sbom-toolchain/package-lock.jsonis excluded by!**/package-lock.jsonbun.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
.changeset/repair-v033-sbom.md.github/sbom-toolchain/package.json.github/workflows/publish.yml.gitignorepackages/dashboard-core/package.jsontests/trust-floor/publish-deps.test.ts
1 participant
Repairs the failed v0.3.3 release gate without changing the immutable package or tag. The workflow now builds a disposable forced production lock and uses exactly pinned CycloneDX 4.2.1 with documented npm-error tolerance and schema validation. Verified against the published v0.3.3 tarball: 185 components and 30 root dependencies; trust-floor test, formatter, lint, and diff checks pass.