Repository navigation
chore(deps): consume bomly-sdk v0.11.0 and every plugin's latest tag; ADR-0045 decides the codec's home - #465
Merged
Merged
Conversation
…R-0045 decides the codec's home bomly-sdk v0.11.0 carries two fixes this repository asked for: a location's identity in the graph fold is the usage unit (module root and declaration site), so a second module root's record of one path survives consolidation (bomly-sdk#73); and a Homebrew coordinate without a stated package URL mints the specification's pkg:brew (bomly-sdk#75). The attribution helper's comment documented the first as an SDK limit; it now records the fix, and a consolidation test pins the case it said was lost. bomly-plugin-grype-matcher and bomly-plugin-syft-detector v0.4.0 carry parts A to C of #459: their codec copies are byte-identical, the LicenseRef (#429) and end-of-life read-back (#438) fixes reached them, and the anchore/syft import used only to recognize a refused format is gone. Both are pinned here so the fixes reach the lite build. ADR-0045 records part D: the SDK owns the SBOM codec in full, executed as the SDK -> plugins -> CLI release train after the copies are a subset of it. The seven analyzer and matcher plugins stay at v0.2.0 on purpose: their newer tags add reachability fields (dynamic_imports_detected, module_root) that move three smoke goldens, which is Dependabot's bump and a golden refresh, not this change. Refs #459. Refs bomly-dev/bomly-sdk#73, bomly-dev/bomly-sdk#75. Co-Authored-By: Claude Fable 5.1 <[email protected]>
Contributor
|
Warning Review limit reachedNext included review available in 27 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (5)
📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe change documents SDK ownership of the SBOM codec, updates three direct dependencies, refreshes location-record attribution, and adds a consolidation test for preserving module-root records. ChangesSDK SBOM codec adoption
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Merge Risk: ⚪ Minimal · up to The dependency update and consolidation coverage do not show a concrete regression requiring changes before merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| github.com/bomly-dev/bomly-plugin-depsdev-license-matcher v0.2.0 | ||
| github.com/bomly-dev/bomly-plugin-govulncheck-analyzer v0.2.0 | ||
| github.com/bomly-dev/bomly-plugin-grype-matcher v0.2.0 | ||
| github.com/bomly-dev/bomly-plugin-grype-matcher v0.4.0 |
| github.com/bomly-dev/bomly-plugin-scorecard-matcher v0.2.0 | ||
| github.com/bomly-dev/bomly-plugin-syft-detector v0.2.0 | ||
| github.com/bomly-dev/bomly-sdk v0.10.0 | ||
| github.com/bomly-dev/bomly-plugin-syft-detector v0.4.0 |
| github.com/bomly-dev/bomly-plugin-syft-detector v0.2.0 | ||
| github.com/bomly-dev/bomly-sdk v0.10.0 | ||
| github.com/bomly-dev/bomly-plugin-syft-detector v0.4.0 | ||
| github.com/bomly-dev/bomly-sdk v0.11.0 |
Contributor
Bomly Diff SummaryCompared Overview
Dependency ChangesSummary: 0 added, 10 version changed, 0 detail changes, 0 removed. Changed Dependencies
Vulnerabilities✅ No vulnerability changes. License ChangesSummary: 0 added, 3 changed, 0 removed. Changed Licenses
Project Posture✅ No project posture changes ( Policy FindingsSummary: 3 introduced, 0 persisted, 0 resolved. Introduced Findings
|
osv, deps.dev license and scorecard matchers to v0.2.2; govulncheck, jsreach, pyreach and jvmreach analyzers to v0.3.2. The analyzers add two reachability fields (dynamic_imports_detected, module_root) that move the three *-reachability smoke goldens; those are regenerated by the Update Smoke Goldens workflow on this branch rather than written from a laptop. Co-Authored-By: Claude Fable 5.1 <[email protected]>
bomly-guy
changed the title
| github.com/bomly-dev/bomly-plugin-scorecard-matcher v0.2.0 | ||
| github.com/bomly-dev/bomly-plugin-syft-detector v0.2.0 | ||
| github.com/bomly-dev/bomly-sdk v0.10.0 | ||
| github.com/bomly-dev/bomly-plugin-depsdev-license-matcher v0.2.2 |
| github.com/bomly-dev/bomly-plugin-syft-detector v0.2.0 | ||
| github.com/bomly-dev/bomly-sdk v0.10.0 | ||
| github.com/bomly-dev/bomly-plugin-depsdev-license-matcher v0.2.2 | ||
| github.com/bomly-dev/bomly-plugin-govulncheck-analyzer v0.3.2 |
| github.com/bomly-dev/bomly-plugin-depsdev-license-matcher v0.2.2 | ||
| github.com/bomly-dev/bomly-plugin-govulncheck-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-grype-matcher v0.4.0 | ||
| github.com/bomly-dev/bomly-plugin-jsreach-analyzer v0.3.2 |
| github.com/bomly-dev/bomly-plugin-govulncheck-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-grype-matcher v0.4.0 | ||
| github.com/bomly-dev/bomly-plugin-jsreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-jvmreach-analyzer v0.3.2 |
| github.com/bomly-dev/bomly-plugin-grype-matcher v0.4.0 | ||
| github.com/bomly-dev/bomly-plugin-jsreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-jvmreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-osv-matcher v0.2.2 |
| github.com/bomly-dev/bomly-plugin-jsreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-jvmreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-osv-matcher v0.2.2 | ||
| github.com/bomly-dev/bomly-plugin-pyreach-analyzer v0.3.2 |
| github.com/bomly-dev/bomly-plugin-jvmreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-osv-matcher v0.2.2 | ||
| github.com/bomly-dev/bomly-plugin-pyreach-analyzer v0.3.2 | ||
| github.com/bomly-dev/bomly-plugin-scorecard-matcher v0.2.2 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1bffb3b185
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
bomly-guy
enabled auto-merge (squash)
September 13, 2026 08:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SDK v0.11.0. Two fixes this repository asked for:
internal/detectors/attribution.godocumented the old behaviour as an SDK limit; the comment now records the fix, andTestConsolidateGraphsKeepsEachModuleRootsRecordOfOneSitepins from the CLI side the exact case the comment said was lost: two detection results holding distinct node instances of one package, each with one root's record of the same site, consolidate to one node with both records.pkg:brew. No golden or doc carriedpkg:homebrew, andmake generateproduced no drift.Every plugin at its latest tag. grype-matcher and syft-detector v0.4.0; osv, deps.dev license and scorecard matchers v0.2.2; govulncheck, jsreach, pyreach and jvmreach analyzers v0.3.2. The Update Smoke Goldens workflow dispatched on this branch (run 34747247890) regenerated every slice and found all goldens byte-identical to what is committed, so no golden moves. Three reachability cases do differ on my laptop with the new analyzers (
dependency_refsabsent,dynamic_imports_detectedpresent); that is an environment-dependent analyzer difference, filed separately, and does not affect CI.#459, what the CLI can do today. Parts A–C (identical plugin copies, the #429/#438 backports, dropping
anchore/syftfrom the plugin codec) landed in grype-matcher and syft-detector v0.4.0 after the issue was measured; pinning them here brings the fixes to the lite build. Part D is decided in ADR-0045: the SDK owns the SBOM codec (option 1 in the issue): the CLI'sinternal/sbomandgraphviewmove to the SDK as one public package, executed as the SDK → plugins → CLI release train, with the copies first made a genuine subset. Part E, the train, is its own work and is not started here.Gates:
make verifypasses;make generateclean; the full smoke suite passed locally on the SDK + grype/syft pins, and CI regenerated every golden unchanged on the final pin set.Refs #459.
🤖 Generated with Claude Code