Repository navigation
chore: refresh org SBOM inventory - #1678
opencode-agent[bot] wants to merge 1295 commits into
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Note
This report is out of date. Scroll down for Devin Review's latest report on this PR.
Devin Review found 3 potential issues.
⚠️ 3 issues in files not directly in the diff
⚠️ Partial inventory appears complete
With 34 of 63 SBOM fetches returning 404, repo_count reports all 63 while component totals cover only 29. The inventory presents partial organization evidence as complete.
⚠️ Permitted licenses trigger violations
For MPL-2.0 components without another prohibited license, flagged reports at least 137 policy violations. Governance therefore escalates expressly permitted dependencies.
⚠️ Permissive alternatives trigger violations
When an SPDX expression offers a permissive alternative, flagged rejects it because another alternative is copyleft. Seven selectable permissive dependencies become policy violations.
seonghobae
added
priority: medium
ChatGPT Codex Connector
There was a problem hiding this comment.
Devin Review found 1 new potential issue.
⚠️ 1 issue in files not directly in the diff
⚠️ Restricted licenses escape policy review
Seven LicenseRef-NVIDIA-Proprietary components are marked unflagged. Unknown and non-standard licenses also disappear from the commercial-permissive policy review.
|
Diagnosis of the
This is deterministic and content-blind, not an Nginx finding. The regenerated Fix: #1946 makes the policy follow the Contents response's blob sha to the Git Blobs API (bounded at 11 MiB, bound back to the same sha and size) and scan the bytes like any inline file. Once it is on Generated by Claude Code |
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The PR refreshes several workflow concurrency groups, adds a coordinator job for CodeQL dispatch, improves allowlist parsing to support multiple trusted actors, and enhances audit coverage reporting. The changes are consistent with the stated rationales, preserve the existing authorization invariants, and introduce no confirmed concrete regressions.
Reviewed changed lines
.github/workflows/agent-mention-noema-dispatch.yml:17 (RIGHT): Moves concurrency from the job level to workflow level. The workflow has a single job and the job-level block is removed, so there is no same-group self-wait risk and queued runs coalesce earlier..github/workflows/agent-mention-opencode-dispatch.yml:17 (RIGHT): Moves concurrency from the job level to workflow level. The workflow has a single job and the job-level block is removed, so there is no same-group self-wait risk and queued runs coalesce earlier..github/workflows/codeql-scan-dispatch.yml:157 (RIGHT): Parses ALLOWED_DISPATCH_ACTOR as a comma-separated allowlist while requiring non-empty actors; an empty allowlist continues to admit nothing..github/workflows/codeql-scan-dispatch.yml:524 (RIGHT): The wake job condition reads validated output required_jobs and only proceeds when non-empty, avoiding a wake with missing job bindings..github/workflows/opencode-review-dispatch.yml:150 (RIGHT): Uses the same comma-separated allowlist parsing with a non-empty guard, permitting multiple trusted dispatch identities without weakening empty-list denial.
Adversarial validation
.github/workflows/agent-mention-noema-dispatch.yml:17 (RIGHT)falsified: Moving concurrency to workflow level could cause a run to wait on its own group when job-level and workflow-level groups match. — The diff removes the job-level concurrency block entirely, leaving only the workflow-level group, so no job requests the group its own run already holds..github/workflows/agent-mention-opencode-dispatch.yml:17 (RIGHT)falsified: Moving concurrency to workflow level could cause a run to wait on its own group when job-level and workflow-level groups match. — The diff removes the job-level concurrency block entirely, leaving only the workflow-level group, so no job requests the group its own run already holds..github/workflows/codeql-scan-dispatch.yml:157 (RIGHT)falsified: Parsing ALLOWED_DISPATCH_ACTOR with IFS=',' could produce an empty actor that is admitted. — The loop checks allowed_actor is non-empty before comparing against DISPATCH_ACTOR and DISPATCH_SENDER, so an empty allowlist admits nothing..github/workflows/codeql-scan-dispatch.yml:524 (RIGHT)falsified: Using validated output required_jobs in the wake condition could let a wake job run when no valid job ids were bound. — The wake job condition explicitly requires needs.validate-dispatch.outputs.required_jobs != '', preventing an empty jobs list from triggering the job..github/workflows/opencode-review-dispatch.yml:150 (RIGHT)falsified: Parsing ALLOWED_DISPATCH_ACTOR with IFS=',' could produce an empty actor that is admitted. — The loop checks allowed_actor is non-empty before comparing against DISPATCH_ACTOR and DISPATCH_SENDER, so an empty allowlist admits nothing.- Residual risk: Low. The audited probes attempted concrete regressions around deadlocks, empty allowlists, and malformed job wake inputs and were all falsified against the changed lines.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
5f264b19eea2559b4d8ce765e158d7d414bf90eb - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
OpenCode Review Overview
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| bash -c 'set -eu | ||
| cd "$1" | ||
| dist_dir="$(mktemp -d)" | ||
| python3 -m maturin build --offline --release -o "$dist_dir" |
f44ab00
| [[package]] | ||
| name = "pyo3" | ||
| version = "0.22.6" | ||
| source = "registry+https://github.com/rust-lang/crates.io-index" | ||
| checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884" | ||
| dependencies = [ | ||
| "cfg-if", | ||
| "indoc", | ||
| "libc", | ||
| "memoffset", | ||
| "once_cell", | ||
| "portable-atomic", | ||
| "pyo3-build-config", | ||
| "pyo3-ffi", | ||
| "pyo3-macros", | ||
| "unindent", | ||
| ] |
| [[package]] | ||
| name = "pyo3" | ||
| version = "0.22.6" | ||
| source = "registry+https://github.com/rust-lang/crates.io-index" | ||
| checksum = "f402062616ab18202ae8319da13fa4279883a2b8a9d9f83f20dbade813ce1884" | ||
| dependencies = [ | ||
| "cfg-if", | ||
| "indoc", | ||
| "libc", | ||
| "memoffset", | ||
| "once_cell", | ||
| "portable-atomic", | ||
| "pyo3-build-config", | ||
| "pyo3-ffi", | ||
| "pyo3-macros", | ||
| "unindent", | ||
| ] |
| "node_modules/fast-uri": { | ||
| "version": "3.1.7", | ||
| "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", | ||
| "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", | ||
| "funding": [ | ||
| { | ||
| "type": "github", | ||
| "url": "https://github.com/sponsors/fastify" | ||
| }, | ||
| { | ||
| "type": "opencollective", | ||
| "url": "https://opencollective.com/fastify" | ||
| } | ||
| ], | ||
| "license": "BSD-3-Clause" | ||
| }, |
| "node_modules/ip-address": { | ||
| "version": "10.7.0", | ||
| "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz", | ||
| "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==", | ||
| "license": "MIT", | ||
| "engines": { | ||
| "node": ">= 12" | ||
| } | ||
| }, |
| "node_modules/ip-address": { | ||
| "version": "10.7.0", | ||
| "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.0.tgz", | ||
| "integrity": "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==", | ||
| "license": "MIT", | ||
| "engines": { | ||
| "node": ">= 12" | ||
| } | ||
| }, |
Exact-head Security RCA and canonical-owner restack
Keep this PR Draft. Fresh exact-head hosted Security, Python Security, SAST, CodeQL, runtime-quality, and qualifying independent review are still required; queued/skipped checks are not GREEN. |
…final-pin-20261014 Merge the source-bound fast-mlsirm license selection and verification wiring, with the dependency gate pinned to central commit e249236. Verified exact PR head 0098f5a against central main e249236. The GitHub merge ref tree ab3e368 matches the isolated local candidate. Seven focused workflow contract tests passed; scoped actionlint passed with only two inherited intentional disabled-release guards ignored. Fresh Trivy 0.74 repository scan found zero fixable HIGH/CRITICAL findings in the inspected lock targets. Independent source reviews found no blocking source defect. Noema App formally approved this exact head. Infrastructure bypass is authorized by the maintainer. OpenCode review is FAILED and its formal App approval is absent; Strix, CodeQL, and scheduler jobs remain QUEUED at decision time. OSV and dependency-review were not locally reproduced. These are incomplete evidence, not passing results. This merge does not accept a release, clear distinct license HOLDs, enable publication, prove twelve wheels, or relax security/coverage thresholds. The release workflow remains disabled at its existing guards. Local evidence: /Users/seonghobae/orca/reports/fmls-central-repair-20261010/central-2628-pin-proposal-20261014/receipt.json and security-appendix.json.
Cap the coverage sandbox to the selected Docker daemon capacity. Refuse private-source coverage transport when the receiving artifact repository is public or unknown. Preserve the local quality and formal review gates. Independent composition source review: b25a471ca7d97d5a34ff5df7be0e3291ed96846619651d676774ae304858ee47 Local full gate: 6518 passed, 4 skipped, scripts/ci statement and branch coverage 100%. Remote Actions, inference, formal App approval: not executed.
Resolve PR2652 stale event visibility finding with current repository identity and typed private metadata before transport and immediately before upload. Public source makes no extra API request. Independent SOURCE_ONLY review d55844bec622fa008977dcf23660bbae9acaae24f876931421fab15bc41ee585. Full gate 6533 passed, 4 skipped, 92 subtests; scripts/ci statements and branches 100%. Runtime and native App approval remain separate.
…ed-runtime-boundaries-20261014 fix(opencode): daemon CPU 용량과 private artifact 경계 수리
This branch has not been deployed
2 participants
Current exact authority (2026-10-01)
7598436eb9126db7bdff00fcf31f6fda15d0f58f; the PR remains open, Draft, and mechanically mergeable. This supersedes the older head records below.36836856075, job110286232014, retained prior repair commits as ancestors withgit merge --strategy=oursbut discarded 23 non-inventory paths from the resulting tree. Ancestry therefore did not prove complete delta succession.1e2d7533a4b8acd04a9bb53e91bc24e0f7769a6aand exact treeb25d761ec7af723523d692df2f647bc76351f474; Security, SAST, Trusted uv, and Runtime Quality are terminal SUCCESS, while CodeQL is Draft-policy SKIPPED and approval remains absent.Automated central SBOM inventory refresh for live non-fork repositories. Review reciprocal, restricted, and NOASSERTION license evidence in docs/sbom/inventory.md against the product's actual distribution and hosted-service model.
Current exact authority (2026-09-30)
f879b4b43abfb9487bd2be500bff5b23f3223a8b; the PR is open, Draft, and mergeable.skipped, not GREEN and not merge authority.pipCommand not pinned by hashfinding in.github/workflows/opencode-review-dispatch.yml, and an outdated-but-unresolved Semgrep dynamic-urllibfinding inscripts/ci/verify_release_maturin_tool_assets.py.Historical blocking state (2026-09-08)
e6b292ce5e104212eaa032579afff1514b865019; livemaincomparison is ahead 70 / behind 0. The effective customer-evidence delta remainsdocs/sbom/inventory.jsonanddocs/sbom/inventory.md.required-workflow-bootstrapis deterministically RED before policy analysis because the Contents API does not inline the 1,148,611-byte JSON and protectedmain's policy caps that evidence path at 1 MiB. This is not an Nginx finding.1cb8cceb8719eb054979d84141cda9a95c0c6873, ahead 5 / behind 0, with bounded Git Blobs fallback plus malicious-content and malformed-evidence tests. Both original and Ready-event same-head Security, SAST, Python Security, and CodeQL PR runs are terminal GREEN. Noema and Strix were materialized but failed on centralorchestrator/freeavailability (HTTP 429 / zero ready routes); OpenCode's derivedCHANGES_REQUESTEDcontains no leaf-source finding. Keep this inventory PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protectedmain, this branch non-force integrates that release, and new exact-head checks plus independent review are valid.orchestrator/freeHTTP 429 is a separate review-transport blocker. Keep this PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protectedmain, this branch non-force integrates that release, and all new exact-head checks plus independent review are valid.