chore: refresh org SBOM inventory - #1678
Draft
opencode-agent[bot] wants to merge 273 commits into
Draft
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Note
This report is out of date. Scroll down for Devin Review's latest report on this PR.
Devin Review found 3 potential issues.
⚠️ 3 issues in files not directly in the diff
⚠️ Partial inventory appears complete
With 34 of 63 SBOM fetches returning 404, repo_count reports all 63 while component totals cover only 29. The inventory presents partial organization evidence as complete.
⚠️ Permitted licenses trigger violations
For MPL-2.0 components without another prohibited license, flagged reports at least 137 policy violations. Governance therefore escalates expressly permitted dependencies.
⚠️ Permissive alternatives trigger violations
When an SPDX expression offers a permissive alternative, flagged rejects it because another alternative is copyleft. Seven selectable permissive dependencies become policy violations.
seonghobae
added
priority: medium
ChatGPT Codex Connector
Contributor
There was a problem hiding this comment.
Devin Review found 1 new potential issue.
⚠️ 1 issue in files not directly in the diff
⚠️ Restricted licenses escape policy review
Seven LicenseRef-NVIDIA-Proprietary components are marked unflagged. Unknown and non-standard licenses also disappear from the commercial-permissive policy review.
![cwl-sbom-inventory[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
seonghobae
enabled auto-merge (squash)
September 5, 2026 04:01
…all three consumers (#1929) (#1932) * fix(dispatch): accept a list of trusted dispatcher identities Two trusted workflows send the opencode-review repository_dispatch: opencode-review.yml through the OpenCode GitHub App (sender opencode-agent[bot], introduced by #1497) and pr-review-merge-scheduler.yml through its own token chain (sender github-actions[bot]). The authorization gate in opencode-review-dispatch.yml compared both actor and sender against a single-valued variable that still names only github-actions[bot], so every app-token dispatch has failed at the first job -- 9611 failures to 466 successes over the workflow's lifetime, and no open PR holds a successful review on its current head (#1929). Parse ALLOWED_DISPATCH_ACTOR as a comma-separated list, exactly as the adjacent ALLOWED_DISPATCH_TARGETS block already does. Semantics are preserved otherwise: actor and sender must both equal the SAME listed identity (a dispatch whose actor and sender are two different listed identities is still rejected), and an empty allowlist admits nothing. This change does not alter the variable. Which identities belong on the list is an authorization decision for the repository owner; this only makes the gate able to express more than one. A single-valued variable keeps working unchanged. Contract test extended in tests/test_opencode_agent_contract.py: both identities pass with a listed allowlist (whitespace around commas tolerated), an unlisted identity is rejected, and mismatched actor/sender is rejected. Negative control: the extended test fails against the unmodified gate on origin/main. REVIEW_DISPATCH_BLOB_SHA recomputed via git hash-object. Verified: 2890 passed, coverage 100%, interrogate 100%. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(dispatch): parse the actor allowlist identically in all three consumers vars.OPENCODE_REPOSITORY_DISPATCH_ACTOR is read by three workflows, and the first commit widened only one of them: opencode-review-dispatch.yml:127 covered by the previous commit codeql-scan-dispatch.yml:155 byte-identical gate, was still exact-match pr-review-fix-scheduler.yml:156 same three conditions, different error line Left as-is, codeql-scan-dispatch would keep rejecting the App identity once #1925's toJSON fix lets it reach line 155, and the scheduler would too. Three consumers of one variable with two parsers is the next drift, so all three now run the same comma-separated parse with the same semantics: actor and sender must both equal the SAME listed identity, empty list admits nothing, single value unchanged. The scheduler keeps its own error line. Tests extended in place for both: a listed identity passes (whitespace around commas tolerated), an unlisted one is rejected, and actor/sender that are two different listed identities are rejected. Negative control: both extended tests fail against the unmodified gates on origin/main. The codeql helper creates tmp_path/bin, so each invocation gets its own subdirectory. No blob-SHA pin references either newly edited workflow. No open PR touches either gate: #1926 covers codeql-scan-dispatch 146-152 and #1741 covers pr-review-fix-scheduler 210-217. Verified: 2891 passed, coverage 100%, interrogate 100%. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(codeql): serialise the dispatched scan matrix with toJSON codeql-pr.yml sends client_payload.matrix as an array, and the dispatch handler assigned it straight into env:, where a value must be a scalar. GitHub rejects the step with "A sequence was not expected", so the step dies before running any of its script and the dispatched scan is skipped. The handler has 0 successes against 136 failures since #1776 added it. The validate step already reads the value through jq and checks `type == "array" and length == 1`, so JSON text is what it was written to consume; no consumer changes. Dropping the `|| ''` fallback is safe because an absent matrix yields the string "null", which fails the same array check and reaches the existing error path. Neither yaml.safe_load nor actionlint 1.7.12 reports this file as invalid -- it is an Actions template rule rather than YAML syntax, so only GitHub's validator rejects it and no local gate catches the class. The added string contract test is therefore the only guard that runs before a dispatch does. Refs #1925 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(codeql): the matrix env: failure is step-scoped, not a whole-file rejection The validate-dispatch job does get a runner and its first steps run; GitHub rejects only the step whose env: receives the array, when that env: is evaluated. Docstring wording corrected to match the observed job timeline. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit f90c23b3c0386e22528cc1ab8680c4a31fa630b9) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
…cks are in flight (#1937) A scheduler run that executes after a 2h+ queue wait finds its scanned PR behind main and merges main into the head before any review is dispatched (inspect_pr, pre-review path). That push cancels every queued check on the old head (22/28 on #1926, 21/30 on #1484) and requeues the PR at the back, so under a saturated queue no head ever finishes its checks: 76 of the 77 PRs merged since 2026-09-04 had 0/12 required contexts satisfied at merge. has_in_flight_check_runs() reuses latest_check_runs()/running_check_state(); the pre-review path now decides "wait" while any newest current-head check run is still queued or running. No age cap on purpose: a cap would restart the loop. The post-approval update path is unchanged (main is strict=true). CLAUDE.md described only the post-approval update; it now names both paths. Refs #1935 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…roup per run id
The workflow-level concurrency key fell back to github.run_id for every
non-PR event, so each main push was its own group and no newer main head
ever retired an older, superseded scan. Measured 2026-09-05T14:27Z in
.github: nine push/main Strix runs outstanding at once (five running, one
past two hours; four queued) against a 10-30 minute normal scan, each
holding a slot under the shared 60-job ceiling.
Scope push events as push-<ref_name> with the existing cancel-in-progress:
true, so a newer head of the same protected branch supersedes the older
scan exactly as a newer PR head does. A push scan covers the whole tree and
publishes no strix commit status, so the newest head subsumes every older
one; schedule and PR-less repository_dispatch keep a unique run id and the
pr_number admission output is unchanged.
Contract: queue-contract docstring records the measurement and a new
assertion pins the push-{0} clause; the quick gate asserts it too; the
2026-09-04 doctoring record carries a dated amendment.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BV96rXhqoR3tYZ9AeAVur4
…cing Requested in review on #1938: during a merge burst each new main head cancels the previous scan, so the latest main is scanned once merging pauses for one scan duration; the weekly schedule scan is the floor. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BV96rXhqoR3tYZ9AeAVur4
… the workflow comment Peer measurement on #1938: 50 main pushes in 24 h, median gap 8.4 min, mean 26.5 min, so only the final head of each merge burst completes a scan. Stated next to the group key so a later coverage measurement does not read the gaps as a defect. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BV96rXhqoR3tYZ9AeAVur4
…1939) build_zdr_prioritized_catalog sorted eligible routes by (cost, ZDR, provider, model) and filled the bounded catalog in that order, taking up to account_cap per account. With the sidecar's ORCHESTRATOR_CATALOG_ ACCOUNT_CAP=8 and ORCHESTRATOR_CATALOG_LIMIT=12 the fill took 8 nvidia_nim + 4 nvidia_nim_sub and stopped before the alphabetically last account: noema-review run 33969842312 admitted 62 free routes across three accounts (free_account_diversity 3) and served 12 NVIDIA routes, of which runtime preflight kept 2, so a stalled NVIDIA endpoint had no other account to fail over to (contextual-orchestrator#1045). Keep the sort; group the sorted rows by (cost, ZDR) tier and fill each tier round-robin across provider accounts until limit, honouring account_cap. Tier order, cap, limit and discovery-order independence are unchanged; the same input now yields 4 + 4 + 4. The launcher's evidence_only filter (#1476) is not the cause on the current pin (2e414d15 includes contextual-orchestrator#949), so that PR stays a complementary hardening. Tests: three new cases (interleave within tier; ZDR tier still first; exhausted accounts hand turns over) were RED against the old loop (3 failed) and are GREEN now. Gate on this tree: 2896 passed, coverage 100%, interrogate 100%. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…idence-2116 fix(pingora): admit bounded HWPX evidence documents without UTF-8 decoding
…sarif-checkout-path-2132
CodeRabbit on #2143: whole-workflow counts could pass if the same string appeared in another step or log line while a scanner or reporter step lost its flag. Check the four scan/retry steps and the reporter step by name. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`gather_findings` consulted only `tool.driver.rules`, so results whose rule lives in `tool.extensions` (every current CodeQL query pack: the real Python artifact has 0 driver rules and 43 extension rules) lost their security-severity and tags and passed the Medium+ gate fail-open (#2150). - `_component_rules`: honour `result.rule.toolComponent` (index | guid | name); absent means driver; unmatched means unresolved, never the wrong component. - `_rule_for_result`: resolve inside the referenced component only, so colliding rule ids stay distinct; validate `rule.index` against the declared id; `ruleId` != `rule.id`, bad indices, non-dict entries are unresolved. - `_finding_from_result`: an unresolved reference with no result-level score gates as `level=unresolved-rule` instead of silently passing. Driver-backed behaviour unchanged. Tests RED 8 -> GREEN 24; file coverage 100%. Full suite under coverage: 3062 passed / 1 skipped / 100% coverage; 13 timing-sensitive failures reproduced as passing in isolation (CPU contention). Closes #2150 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* fix(scheduler): recheck cancellation races * test(scheduler): bound cancellation race outcomes * fix(scheduler): preserve runs started during cancellation * fix: preserve runs after cancellation race * test: document coalescer callbacks
…mplicit model timeout) Advance ORCHESTRATOR_PIN_SHA from 414f2297 to protected main@767e67fbc6b881a452761f32abb69b9971b9b03b, the merge of contextual-orchestrator#1053. Under the old pin ModelClient defaulted to timeout=90 and the review gateway inherited it, so NVIDIA NIM google/gemma-4-31b-it attempts in the Noema sidecar timed out at exactly 90 s (15 of 27 attempts in fast-mlsirm#1860 run 34748511702) and the gateway answered 502 provider_connection_error after ~20 min of circuit retries. #1053 makes the model timeout null by default and administrator configured per model. Update the sidecar contract test constant, ADR-0003 (current pin and a 2026-09-13 amendment), and CHANGELOG. tests/test_contextual_orchestrator_* and sidecar contract tests: 225 passed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ar-pin-1053 chore(sidecar): advance contextual-orchestrator pin to 767e67fb (no implicit model timeout)
…on-root-20260913 # Conflicts: # CHANGELOG.md
* fix(noema): extract office documents for review context * fix(noema): harden document XML extraction * fix(noema): install document XML dependency in quality CI
Follow-up to #2172. The required hosted workflows remained queued repository-wide with zero available Actions runners; local focused, fixture, security, and syntax validation passed for the exact head. Apply the reviewed document-reader fixes.
…-extension-rules-2150
…ags-sarif-checkout-path-2132
…gate-fold-20260913
…thon-root-20260913 fix(opencode): admit immutable python source roots
…te-extension-rules-2150 fix(codeql): resolve SARIF rules from the referenced tool component
…s-sarif-checkout-path-2132 fix(security-scan): use current OSV output flags and bind SARIF upload to the head checkout
…te-fold-20260913 fix(sast-semgrep): fold the changed-scope gate into its single consumer job
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated central SBOM inventory refresh for live non-fork repositories. Review reciprocal, restricted, and NOASSERTION license evidence in docs/sbom/inventory.md against the product's actual distribution and hosted-service model.
Current blocking state (2026-09-08)
e6b292ce5e104212eaa032579afff1514b865019; livemaincomparison is ahead 70 / behind 0. The effective customer-evidence delta remainsdocs/sbom/inventory.jsonanddocs/sbom/inventory.md.required-workflow-bootstrapis deterministically RED before policy analysis because the Contents API does not inline the 1,148,611-byte JSON and protectedmain's policy caps that evidence path at 1 MiB. This is not an Nginx finding.1cb8cceb8719eb054979d84141cda9a95c0c6873, ahead 5 / behind 0, with bounded Git Blobs fallback plus malicious-content and malformed-evidence tests. Both original and Ready-event same-head Security, SAST, Python Security, and CodeQL PR runs are terminal GREEN. Noema and Strix were materialized but failed on centralorchestrator/freeavailability (HTTP 429 / zero ready routes); OpenCode's derivedCHANGES_REQUESTEDcontains no leaf-source finding. Keep this inventory PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protectedmain, this branch non-force integrates that release, and new exact-head checks plus independent review are valid.orchestrator/freeHTTP 429 is a separate review-transport blocker. Keep this PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protectedmain, this branch non-force integrates that release, and all new exact-head checks plus independent review are valid.