chore: refresh org SBOM inventory - #1678
Open
opencode-agent[bot] wants to merge 40 commits into
Open
Conversation
![cwl-sbom-inventory[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Note
This report is out of date. Scroll down for Devin Review's latest report on this PR.
Devin Review found 3 potential issues.
⚠️ 3 issues in files not directly in the diff
⚠️ Partial inventory appears complete
With 34 of 63 SBOM fetches returning 404, repo_count reports all 63 while component totals cover only 29. The inventory presents partial organization evidence as complete.
⚠️ Permitted licenses trigger violations
For MPL-2.0 components without another prohibited license, flagged reports at least 137 policy violations. Governance therefore escalates expressly permitted dependencies.
⚠️ Permissive alternatives trigger violations
When an SPDX expression offers a permissive alternative, flagged rejects it because another alternative is copyleft. Seven selectable permissive dependencies become policy violations.
seonghobae
added
priority: medium
ChatGPT Codex Connector
Contributor
There was a problem hiding this comment.
Devin Review found 1 new potential issue.
⚠️ 1 issue in files not directly in the diff
⚠️ Restricted licenses escape policy review
Seven LicenseRef-NVIDIA-Proprietary components are marked unflagged. Unknown and non-standard licenses also disappear from the commercial-permissive policy review.
seonghobae
enabled auto-merge (squash)
September 5, 2026 04:01
…all three consumers (#1929) (#1932) * fix(dispatch): accept a list of trusted dispatcher identities Two trusted workflows send the opencode-review repository_dispatch: opencode-review.yml through the OpenCode GitHub App (sender opencode-agent[bot], introduced by #1497) and pr-review-merge-scheduler.yml through its own token chain (sender github-actions[bot]). The authorization gate in opencode-review-dispatch.yml compared both actor and sender against a single-valued variable that still names only github-actions[bot], so every app-token dispatch has failed at the first job -- 9611 failures to 466 successes over the workflow's lifetime, and no open PR holds a successful review on its current head (#1929). Parse ALLOWED_DISPATCH_ACTOR as a comma-separated list, exactly as the adjacent ALLOWED_DISPATCH_TARGETS block already does. Semantics are preserved otherwise: actor and sender must both equal the SAME listed identity (a dispatch whose actor and sender are two different listed identities is still rejected), and an empty allowlist admits nothing. This change does not alter the variable. Which identities belong on the list is an authorization decision for the repository owner; this only makes the gate able to express more than one. A single-valued variable keeps working unchanged. Contract test extended in tests/test_opencode_agent_contract.py: both identities pass with a listed allowlist (whitespace around commas tolerated), an unlisted identity is rejected, and mismatched actor/sender is rejected. Negative control: the extended test fails against the unmodified gate on origin/main. REVIEW_DISPATCH_BLOB_SHA recomputed via git hash-object. Verified: 2890 passed, coverage 100%, interrogate 100%. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(dispatch): parse the actor allowlist identically in all three consumers vars.OPENCODE_REPOSITORY_DISPATCH_ACTOR is read by three workflows, and the first commit widened only one of them: opencode-review-dispatch.yml:127 covered by the previous commit codeql-scan-dispatch.yml:155 byte-identical gate, was still exact-match pr-review-fix-scheduler.yml:156 same three conditions, different error line Left as-is, codeql-scan-dispatch would keep rejecting the App identity once #1925's toJSON fix lets it reach line 155, and the scheduler would too. Three consumers of one variable with two parsers is the next drift, so all three now run the same comma-separated parse with the same semantics: actor and sender must both equal the SAME listed identity, empty list admits nothing, single value unchanged. The scheduler keeps its own error line. Tests extended in place for both: a listed identity passes (whitespace around commas tolerated), an unlisted one is rejected, and actor/sender that are two different listed identities are rejected. Negative control: both extended tests fail against the unmodified gates on origin/main. The codeql helper creates tmp_path/bin, so each invocation gets its own subdirectory. No blob-SHA pin references either newly edited workflow. No open PR touches either gate: #1926 covers codeql-scan-dispatch 146-152 and #1741 covers pr-review-fix-scheduler 210-217. Verified: 2891 passed, coverage 100%, interrogate 100%. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* fix(codeql): serialise the dispatched scan matrix with toJSON codeql-pr.yml sends client_payload.matrix as an array, and the dispatch handler assigned it straight into env:, where a value must be a scalar. GitHub rejects the step with "A sequence was not expected", so the step dies before running any of its script and the dispatched scan is skipped. The handler has 0 successes against 136 failures since #1776 added it. The validate step already reads the value through jq and checks `type == "array" and length == 1`, so JSON text is what it was written to consume; no consumer changes. Dropping the `|| ''` fallback is safe because an absent matrix yields the string "null", which fails the same array check and reaches the existing error path. Neither yaml.safe_load nor actionlint 1.7.12 reports this file as invalid -- it is an Actions template rule rather than YAML syntax, so only GitHub's validator rejects it and no local gate catches the class. The added string contract test is therefore the only guard that runs before a dispatch does. Refs #1925 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(codeql): the matrix env: failure is step-scoped, not a whole-file rejection The validate-dispatch job does get a runner and its first steps run; GitHub rejects only the step whose env: receives the array, when that env: is evaluated. Docstring wording corrected to match the observed job timeline. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> (cherry picked from commit f90c23b3c0386e22528cc1ab8680c4a31fa630b9) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
…cks are in flight (#1937) A scheduler run that executes after a 2h+ queue wait finds its scanned PR behind main and merges main into the head before any review is dispatched (inspect_pr, pre-review path). That push cancels every queued check on the old head (22/28 on #1926, 21/30 on #1484) and requeues the PR at the back, so under a saturated queue no head ever finishes its checks: 76 of the 77 PRs merged since 2026-09-04 had 0/12 required contexts satisfied at merge. has_in_flight_check_runs() reuses latest_check_runs()/running_check_state(); the pre-review path now decides "wait" while any newest current-head check run is still queued or running. No age cap on purpose: a cap would restart the loop. The post-approval update path is unchanged (main is strict=true). CLAUDE.md described only the post-approval update; it now names both paths. Refs #1935 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…1939) build_zdr_prioritized_catalog sorted eligible routes by (cost, ZDR, provider, model) and filled the bounded catalog in that order, taking up to account_cap per account. With the sidecar's ORCHESTRATOR_CATALOG_ ACCOUNT_CAP=8 and ORCHESTRATOR_CATALOG_LIMIT=12 the fill took 8 nvidia_nim + 4 nvidia_nim_sub and stopped before the alphabetically last account: noema-review run 33969842312 admitted 62 free routes across three accounts (free_account_diversity 3) and served 12 NVIDIA routes, of which runtime preflight kept 2, so a stalled NVIDIA endpoint had no other account to fail over to (contextual-orchestrator#1045). Keep the sort; group the sorted rows by (cost, ZDR) tier and fill each tier round-robin across provider accounts until limit, honouring account_cap. Tier order, cap, limit and discovery-order independence are unchanged; the same input now yields 4 + 4 + 4. The launcher's evidence_only filter (#1476) is not the cause on the current pin (2e414d15 includes contextual-orchestrator#949), so that PR stays a complementary hardening. Tests: three new cases (interleave within tier; ZDR tier still first; exhausted accounts hand turns over) were RED against the old loop (3 failed) and are GREEN now. Gate on this tree: 2896 passed, coverage 100%, interrogate 100%. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated central SBOM inventory refresh for live non-fork repositories. Review reciprocal, restricted, and NOASSERTION license evidence in docs/sbom/inventory.md against the product's actual distribution and hosted-service model.