fix(sbom): enforce hourly non-fork commercial inventory

[seonghobae]

Goal

Make central software-supply-chain evidence match the commercialization contract: every hourly inventory run must exclude fork repositories before collection, surface license evidence for commercial-policy review, and preserve concurrent publication history.

TDD and implementation

The first commit added a RED contract proving the protected scheduler was wrong: weekly cadence, no fork invariant at the workflow boundary, and recurring --force-with-lease publication. Exact head 9caa175e61f43180c8724acb97dbdd974c40f855 now makes that contract GREEN in source:

• cron: "0 * * * *" refreshes evidence hourly;
• GitHub discovery requests nameWithOwner,isFork and admits only .isFork == false;
• the verified set is passed explicitly as repeatable --repo arguments, so the protected aggregator's broader org discovery is bypassed;
• an empty non-fork set fails closed;
• generated inventory publication preserves the prior remote head as ancestry with an ours merge and uses a normal push, so concurrent movement is rejected rather than history-rewritten;
• the branch was non-destructively merged with current protected main@6eb93bce8575ba734f5ce6cb9267d76f18f73680 before this exact head.

Commercial-license interpretation

docs/doctoring/hourly-commercial-license-sbom-remediation.md records the replacement policy and current standards baseline. GPL-family flags are review evidence, not a claim that GPL prohibits commercial use. Remediation evaluates actual distribution, hosted-service, linkage, modification and reciprocal obligations, then removes unused dependencies, replaces with permissive maintained equivalents, or clean-room implements only the bounded required capability without copying protected source. Unknown, non-commercial, evaluation-only, field-of-use and incompatible source-available terms fail closed to review.

SPDX 3.0 and CycloneDX 1.7/ECMA-424 2nd Edition are the current stable evidence baselines as of 2026-09-01; CycloneDX 2.0 is announced but not yet the stable baseline.

Scope and ownership

This PR deliberately does not modify scripts/ci/sbom_inventory_aggregator.py or its parser tests because #932 is the existing canonical lane for that file. The remaining classifier work there should move from substring-only triage toward explicit SPDX-expression-aware allow/review/replace outcomes without weakening detection.

Hosted exact-head GitHub Checks and semantic reviews must regenerate on 9caa175e61f43180c8724acb97dbdd974c40f855; queued predecessor evidence is not acceptance.

[coderabbitai]

Warning

Review limit reached

Next included review available in 6 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0cb0b13f-8cd4-4aef-ad12-7e3ae5b1252c

📥 Commits

Reviewing files that changed from the base of the PR and between f59bad1 and 674e0d5.

📒 Files selected for processing (3)

• .github/workflows/sbom-inventory-scheduler.yml
• docs/doctoring/hourly-commercial-license-sbom-remediation.md
• tests/test_sbom_inventory_scheduler_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 4 new potential issues.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

QUEUE_SATURATION_CHICKEN_EGG verified again on exact head 674e0d5d754d710d87c9aade1ee1da05aa299cb1 after non-destructive reconciliation with protected main@f59bad10b0be2861fda22425106647f005788487: GitHub reports mergeable; current-head Devin Review and CodeRabbit are success; all review threads are resolved; the source contract includes hourly cadence, explicit fork=false discovery/filtering, organization-wide credential fail-closed behavior, authenticated non-force publication, and executable step-scoped tests. The only current-head required workflow evidence is queued, while the repository currently has 828 queued Actions runs. No substantive test/security/review/provenance finding remains, so queue saturation is the remaining admission cycle rather than a source blocker.