fix(sbom): preserve portable Ruff hash locks - #226
Conversation
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.1 to 0.16.3. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.1...0.16.3) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughCI 잠금 파일이 하나의 패키지에 여러 SHA-256 해시를 저장하도록 변경되었습니다. 런타임 SBOM 검증은 다이제스트가 해시 세트에 포함되는지 확인합니다. 중복 해시와 누락된 다이제스트에 대한 회귀 테스트가 추가되었습니다. Changes런타임 잠금 해시 세트
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to Release SBOM validation now supports platform-specific hashes for the pinned Ruff version while continuing to reject unreviewed artifact digests. The change has targeted regression coverage and is ready to merge. Sequence Diagram(s)sequenceDiagram
participant LockFile as requirements-ci.txt
participant Loader as _load_runtime_lock
participant Validator as validate_runtime_lock
participant Manifest as Runtime SBOM
LockFile->>Loader: 여러 SHA-256 해시 제공
Loader->>Validator: 버전, 마커, 해시 튜플 전달
Manifest->>Validator: 검토된 다이제스트 제공
Validator-->>Manifest: 포함 여부에 따른 검증 결과 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Additional exact-platform reproduction from the isolated model-response-lifetime lane based on protected bd0339b: uv venv .venv followed by uv pip install --python .venv/bin/python --require-hashes -r requirements-ci.txt fails before the owner Python suite. For Ruff 0.16.1 the lock expects 39897739f112253ee4fdd2e8aa9a4f9ded99fb2be367d5f31dfa4ded6025584c; macOS ARM64 download computes e0d4c20532fca4f7fa609369161d968dd28f65d83dabbd61d8e9c7edbf7001f6. The live PyPI JSON independently maps those digests to manylinux x86_64 and macosx_11_0_arm64 wheels respectively. This supports the portable hash-set requirement, not bypassing digest checks. No lock or SBOM-parser changes made in the runtime lane; preserving this PR as the existing repair owner. Please retain macOS ARM64 artifact admission in the reviewed multi-platform hash set and source-distribution/SBOM conformance evidence. This comment is a reproduction handoff, not approval or a claim that the unmerged repair was consumed. |
|
Resolved the dependency-review availability prerequisite without weakening the gate. Before: the exact dependency comparison Changed only Dependency graph to enabled. The fresh page showed Disable dependency graph; automatic dependency submission remained Disabled. No permission, branch protection, secret protection, automatic update, billing, or approval settings changed. After: the identical comparison succeeds with 2 changes, and SBOM succeeds with 30 packages. This is before/after API evidence following the actual setting change, not a reinterpretation of the old failed check. Requested one rerun of the failed dependency-review job after the repair. Run |
EgressWeave #226: exact-head macOS review evidenceReviewed head: Results
Full evidence: Review and delivery boundaryThe four-file PR diff was read and all three existing review threads were The dependency-graph repair is recorded in comment5562755534. Its requested This validates the prerequisite PR on the previously failing macOS platform; |
seonghobae
added
bug
ChatGPT Codex Connector
Signed-off-by: Seongho Bae <me@seonghobae.me>
Egress226 ordinary protected-main integrationLocal merge3f1d8767c08ae0f2d703e550c690369c7ac5e50c has parents Explicit git diff against b0 is empty for src/, requirements-ci.txt, Exact local merge verification session76004 terminated exit0: Rationale: b0's only CodeQL-required run used old canonical8c085835 source and Normal push was initiated only after rechecking remote branch stillb0. No force, |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
CHANGELOG.md— repository behaviorrequirements-ci.txt— repository behaviorscripts/ci/generate_release_sbom.py— review and security gate shell pathtests/test_release_lock_hash_sets.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: CHANGELOG.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
R1 --> V1["required checks"]
Evidence --> S2["Repository file: requirements-ci.txt"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: requirements-ci.txt"]
R2 --> V2["required checks"]
Evidence --> S3["CI script: generate_release_sbom.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: generate_release_sbom.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_release_lock_hash_sets.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_release_lock_hash_sets.py"]
R4 --> V4["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
3f1d8767c08ae0f2d703e550c690369c7ac5e50c - Workflow run: 34080563601
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Repository file: CHANGELOG.md"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Repository file: CHANGELOG.md"]
R1 --> V1["required checks"]
Evidence --> S2["Repository file: requirements-ci.txt"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Repository file: requirements-ci.txt"]
R2 --> V2["required checks"]
Evidence --> S3["CI script: generate_release_sbom.py"]
S3 --> I3["review and security gate shell path"]
I3 --> R3["Review risk: CI script: generate_release_sbom.py"]
R3 --> V3["bash -n plus Strix self-test"]
Evidence --> S4["Test: test_release_lock_hash_sets.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_release_lock_hash_sets.py"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
2 participants
Buyer problem
Ruff 0.16.3 publishes several platform-specific artifacts. Dependabot correctly records all reviewed SHA-256 hashes, but the release-SBOM validator rejected any lock entry with more than one hash, so every supported Python CI lane failed before release evidence could be generated.
Repair
This branch retains the Ruff 0.16.3 exact version and reviewed hashes, then changes the deterministic lock parser to accept one or more unique canonical SHA-256 digests for a pinned package. Runtime SBOM components must still match the pinned version and marker and their reviewed digest must be a member of the immutable hash set.
The bounded repair adds focused regressions for portable multi-hash entries, duplicate-hash rejection, and manifest-digest membership, updates the changelog, executes the complete hash-locked test/coverage/compile suite, and removes its one-shot writer workflow before delivery.
Scope
Summary by CodeRabbit
버그 수정
기타