Generate-sbom #900
Generate-sbom #900
Conversation
📝 WalkthroughWalkthroughAdds CycloneDX SBOM generation: a new script creates a JSON SBOM using a temporary virtualenv; CI runs that script during the build and uploads Changes
Sequence DiagramsequenceDiagram
autonumber
participant CI as CI Workflow
participant Script as script/create_sbom.py
participant Venv as Temporary Venv
participant Pip as pip (in venv)
participant CycloneDX as cyclonedx_py
participant Artifacts as SBOM (*.cdx.json)
CI->>Script: run create_sbom.py
Script->>Venv: create temporary venv
Script->>Pip: pip install project[ sbom ] (in venv)
Pip-->>Script: deps installed
Script->>CycloneDX: run cyclonedx_py to generate SBOM
CycloneDX->>Artifacts: write versioned .cdx.json
Script->>Venv: remove temporary venv
Script-->>CI: exit (SBOM ready for upload)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (19)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
script/create_sbom.py (2)
11-11: Clarify the version import location.The
__version__import occurs beforedfetchis installed in the temporary virtual environment (Line 38). This means the version is read from the host environment rather than from the package being built in the temporary venv. While this is likely intentional (to capture the version of the code under build), it could be confusing to future maintainers.Consider adding a comment explaining this design choice:
+# Import version from host environment (the code being built) +# before creating the temporary venv for SBOM generation from dfetch import __version__
37-43: Consider enhancing error visibility.The subprocess calls use
check_call, which will raise an exception on failure but doesn't capture output for debugging. If the SBOM generation fails in CI, diagnosing the issue might be difficult.🔎 Optional improvements for better error visibility
with temporary_venv() as python: + logging.info(f"Installing dependencies: {DEPS}") - subprocess.check_call([python, "-m", "pip", "install", DEPS]) # nosec + subprocess.check_call( + [python, "-m", "pip", "install", DEPS], + stdout=sys.stdout, + stderr=sys.stderr + ) # nosec + + logging.info(f"Generating SBOM to {OUTPUT_FILE}") - subprocess.check_call( # nosec + subprocess.check_call( [python, "-m", "cyclonedx_py", "environment", "-o", str(OUTPUT_FILE)], + stdout=sys.stdout, + stderr=sys.stderr - ) + ) # nosec logging.info(f"SBOM generated at {OUTPUT_FILE}")
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/build.yml.gitignorepyproject.tomlscript/create_sbom.py
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-25T23:53:05.742Z
Learnt from: spoorcc
Repo: dfetch-org/dfetch PR: 861
File: .github/workflows/build.yml:120-125
Timestamp: 2025-12-25T23:53:05.742Z
Learning: When building macOS PKG installers with fpm in CI, account for the known issue (fpm #1996) where --prefix can be duplicated (e.g., /opt/dfetch becomes /opt/dfetch/opt/dfetch). In the workflow at .github/workflows/build.yml, verify install paths and PATH entries do not assume a single-prefix layout. Adjust packaging scripts or fpm arguments to normalize the final install location and update PATH references accordingly. Add a test step to validate the expected runtime paths after installation.
Applied to files:
.github/workflows/build.yml
🧬 Code graph analysis (1)
script/create_sbom.py (1)
features/environment.py (1)
tmpdir(12-24)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: test (windows-latest, 3.10)
- GitHub Check: test (windows-latest, 3.12)
- GitHub Check: build (windows-latest)
- GitHub Check: build (ubuntu-latest)
- GitHub Check: test-cygwin
- GitHub Check: DevContainer Build & Test
🔇 Additional comments (5)
.gitignore (1)
15-15: LGTM!The ignore pattern correctly excludes generated CycloneDX SBOM files from version control.
script/create_sbom.py (1)
21-35: LGTM!The temporary virtual environment implementation is clean and handles platform differences correctly. The context manager pattern ensures proper cleanup.
.github/workflows/build.yml (2)
83-83: LGTM!The SBOM generation is correctly integrated into the build workflow. It runs after dependencies are installed but before the binary is created, which is appropriate timing.
96-96: LGTM!The artifact upload pattern correctly includes the generated SBOM files (*.cdx.json) alongside the platform-specific packages.
pyproject.toml (1)
108-108: No action needed—cyclonedx-bom version 7.2.1 is valid and current.Version 7.2.1 is the latest release on PyPI (released October 29, 2025) with no known security vulnerabilities. The pinned version is appropriate.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.