ci(release): publish CycloneDX SBOM - #180
Conversation
Generate a CycloneDX SBOM from published Forge and HeliosLite assets and upload it to the release for machine-verifiable dependency evidence. Co-Authored-By: ForgeCode <noreply@forgecode.dev>
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| let release_build_job = ReleaseBuilderJob::new("${{ github.event.release.tag_name }}") | ||
| .release_id("${{ github.event.release.id }}"); | ||
| let sbom_job = Job::new("Generate release SBOM") | ||
| .needs("build_release") |
There was a problem hiding this comment.
Suggestion: The SBOM job depends only on build_release, so it runs concurrently with attest_release_assets. The attestation job can download and attest the release assets before this job uploads the SBOM, producing a release whose newly generated SBOM is not covered by the release attestation. Make the attestation job depend on the SBOM job, or otherwise enforce the required upload-before-attestation ordering. [race condition]
Severity Level: Major ⚠️
- ⚠️ Release attestation can omit the generated CycloneDX SBOM.
- ⚠️ Consumers cannot verify provenance for the SBOM release asset.
- ❌ Release asset integrity coverage is incomplete.
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/forge_ci/src/workflows/release_publish.rs
**Line:** 12:12
**Comment:**
*Race Condition: The SBOM job depends only on `build_release`, so it runs concurrently with `attest_release_assets`. The attestation job can download and attest the release assets before this job uploads the SBOM, producing a release whose newly generated SBOM is not covered by the release attestation. Make the attestation job depend on the SBOM job, or otherwise enforce the required upload-before-attestation ordering.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix| "artifact-name", | ||
| "forgecode-${{ github.event.release.tag_name }}.cdx.json", | ||
| ) | ||
| .input( | ||
| "output-file", | ||
| "forgecode-${{ github.event.release.tag_name }}.cdx.json", |
There was a problem hiding this comment.
Suggestion: The release tag is interpolated directly into output-file. GitHub release tags may contain /, so a tag such as release/foo expands this to forgecode-release/foo.cdx.json; the nested parent directory is not created, causing SBOM output generation or release upload to fail. Use a filesystem-safe fixed output path and set the release asset name separately. [api mismatch]
Severity Level: Major ⚠️
- ❌ SBOM generation fails for slash-containing release tags.
- ❌ The release workflow cannot publish its SBOM asset.
- ⚠️ Release automation requires tag-name restrictions.
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** crates/forge_ci/src/workflows/release_publish.rs
**Line:** 31:36
**Comment:**
*Api Mismatch: The release tag is interpolated directly into `output-file`. GitHub release tags may contain `/`, so a tag such as `release/foo` expands this to `forgecode-release/foo.cdx.json`; the nested parent directory is not created, causing SBOM output generation or release upload to fail. Use a filesystem-safe fixed output path and set the release asset name separately.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c183f10d20
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| --pattern "forge-*" \ | ||
| --pattern "helioslite-*" |
There was a problem hiding this comment.
The release build uploads forge_dbd-${{ matrix.target }} binaries and checksums, but this download selects only forge-* and helioslite-*; as gh release download --help defines --pattern as downloading only assets matching the glob, forge_dbd-* does not match either pattern. Consequently, the SBOM action scans none of the published daemon artifacts, leaving that shipped executable uncovered; add a forge_dbd-* pattern in both the workflow model and generated workflow.
Useful? React with 👍 / 👎.
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
the
size:M
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
User description
Summary
Verification
cargo test -p forge_ci --test ci(8 passed)cargo fmt --all -- --check(passed; nightly-only config warnings only)cargo check -p forge_ci --locked(passed)git diff --check(passed)actionlint .github/workflows/release.yml(pre-existing SC2193/SC1075 findings at lines 153/156 only; no findings on this SBOM block)PR #179 is intentionally untouched. This PR requires normal hosted review and CI before merge.
CodeAnt-AI Description
Publish a CycloneDX software bill of materials with every release
What Changed
Impact
✅ Downloadable dependency inventory for every release✅ Machine-readable release composition✅ SBOM generation included in the release process💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.