Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Dec 8, 2025

Addresses feedback on hardcoded delay values (1500ms and 3000ms) used when submitting dependency snapshots before requesting dependency review diffs.

Changes

  • Added snapshotIngestionDelayMs and retryIngestionDelayMs options to CollectorOptions interface with defaults of 1500ms and 3000ms respectively
  • Replaced hardcoded setTimeout values with configurable options in both force-submission and retry-on-404 flows
  • Added comments explaining delays prevent race conditions during snapshot ingestion
  • Added CLI arguments --snapshot-ingestion-delay and --retry-ingestion-delay to allow customization from the command line

Usage

From code:

const collector = new SbomCollector({
  token: process.env.GITHUB_TOKEN,
  org: 'my-org',
  snapshotIngestionDelayMs: 2000,  // Customize for slower GHES instances
  retryIngestionDelayMs: 5000
});

From CLI:

github-sbom-toolkit --org my-org --snapshot-ingestion-delay 2000 --retry-ingestion-delay 5000

Delays remain at original values by default but can now be tuned for GitHub instances with different ingestion characteristics.


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Copilot AI and others added 2 commits December 8, 2025 18:29
Co-authored-by: aegilops <41705651+aegilops@users.noreply.github.com>
Co-authored-by: aegilops <41705651+aegilops@users.noreply.github.com>
Copilot AI changed the title [WIP] Address feedback on dependency review PR Make snapshot ingestion delays configurable Dec 8, 2025
Copilot AI requested a review from aegilops December 8, 2025 18:35
@aegilops
Copy link
Contributor

aegilops commented Dec 8, 2025

@copilot please add CLI arguments to allow users to pass in these values from the command line

Co-authored-by: aegilops <41705651+aegilops@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Dec 8, 2025

@copilot please add CLI arguments to allow users to pass in these values from the command line

Added CLI arguments for both delay options:

  • --snapshot-ingestion-delay (default: 1500ms)
  • --retry-ingestion-delay (default: 3000ms)

Example usage:

github-sbom-toolkit --org my-org --branch-scan --force-submission \
  --snapshot-ingestion-delay 2000 --retry-ingestion-delay 5000

The CLI arguments are wired to the SbomCollector constructor and use the same default values as the programmatic API.

Help output:

  --snapshot-ingestion-delay            Delay (ms) after snapshot submission to
                                        allow ingestion before dependency review
                                        (default: 1500ms)
                                                        [number] [default: 1500]
  --retry-ingestion-delay               Delay (ms) after snapshot submission
                                        before retrying dependency review on 404
                                        (default: 3000ms)
                                                        [number] [default: 3000]

Changes in commit e7f34a6

@aegilops aegilops marked this pull request as ready for review December 9, 2025 09:18
@aegilops aegilops merged commit de9be57 into dependency-review Dec 9, 2025
@aegilops aegilops deleted the copilot/sub-pr-21-a1e28fa4-4def-4364-b631-731c97106a16 branch December 9, 2025 17:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants