Generate a SBOM out of the vendored dependencies#661
Conversation
jviotti
force-pushed
the
sbom-vendorpull
branch
from
1f42fd5 to
3b0f416
Compare
🤖 Augment PR SummarySummary: This PR adds generation of an SPDX SBOM for vendored (non-npm) dependencies and embeds it into the Enterprise container image. Changes:
Technical Notes: The resulting image includes both 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| function findDependenciesFiles(directory) { | ||
| const result = []; | ||
| for (const entry of readdirSync(directory, { withFileTypes: true })) { | ||
| if (entry.name === ".git") { |
There was a problem hiding this comment.
findDependenciesFiles() currently recurses the entire repo tree and only skips .git; in the Docker build this will also traverse /source/node_modules after npm ci, which can be extremely large and may make SBOM generation slow or flaky. Consider explicitly excluding node_modules (and any other known-large build artifacts) from the walk.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 3 files
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="enterprise/scripts/sbom-vendorpull.js">
<violation number="1" location="enterprise/scripts/sbom-vendorpull.js:63">
P2: `findDependenciesFiles()` only excludes `.git` from the recursive directory walk. In the Docker build context, this will also traverse `/source/node_modules` (populated by the earlier `npm ci` step), `build` directories, and other large trees that cannot contain `DEPENDENCIES` files. This will make SBOM generation unnecessarily slow. Consider also skipping `node_modules`, `build`, and other known-large artifact directories.</violation>
<violation number="2" location="enterprise/scripts/sbom-vendorpull.js:105">
P2: De-duplicating by URL drops distinct versions of the same dependency, which can omit packages from the SBOM when multiple versions share a URL. Track uniqueness by name+version instead.</violation>
<violation number="3" location="enterprise/scripts/sbom-vendorpull.js:161">
P1: The `creationInfo` object is missing the `created` timestamp field, which is **required** by the SPDX 2.3 specification (section 6.9). Without it, SPDX validators and downstream SBOM consumers will likely reject this document as non-compliant. Add a `created` field with an ISO 8601 / UTC timestamp (e.g., `new Date().toISOString()`).</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
jviotti
force-pushed
the
sbom-vendorpull
branch
from
3b0f416 to
ee62c83
Compare
1 participant
Signed-off-by: Juan Cruz Viotti jv@jviotti.com