feat: deny releases using experimental Hermeto backends#1736
Conversation
|
Warning Review limit reached
More reviews will be available in 52 minutes. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThis PR adds a new ChangesExperimental Hermeto backend detection
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@policy/release/sbom_spdx/sbom_spdx.rego`:
- Around line 370-386: The rule deny contains result currently requires finding
an externalRef with referenceType "purl" (variable externalref and id :=
externalref.referenceLocator), which causes annotated packages without a purl to
skip this deny; modify the logic in the deny rule so that if no purl externalRef
exists you still produce a result by deriving id from a fallback identifier
(e.g., pkg.name or pkg.SPDXID) instead of requiring externalref; update the
variables used by metadata.result_helper_with_term (the id passed to
metadata.result_helper_with_term and any uses of pkg.externalRefs) to use the
purl when present and the fallback when absent so annotated SPDX packages are
denied consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: b580bfad-756c-4f64-9a1b-317e1dbf7c92
📒 Files selected for processing (8)
antora/docs/modules/ROOT/pages/packages/release_sbom_cyclonedx.adocantora/docs/modules/ROOT/pages/packages/release_sbom_spdx.adocantora/docs/modules/ROOT/pages/release_policy.adocantora/docs/modules/ROOT/partials/release_policy_nav.adocpolicy/release/sbom_cyclonedx/sbom_cyclonedx.regopolicy/release/sbom_cyclonedx/sbom_cyclonedx_test.regopolicy/release/sbom_spdx/sbom_spdx.regopolicy/release/sbom_spdx/sbom_spdx_test.rego
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Builds whose SBOM contains components fetched by an experimental Hermeto backend (hermeto:backend:experimental:*) now violate the release policy. Covers both SPDX and CycloneDX SBOM formats. Ref: EC-1799 Signed-off-by: Jan Smid <jsmid@redhat.com> Co-Authored-By: Claude
| # - redhat_rpms | ||
| deny contains result if { | ||
| some s in sbom.cyclonedx_sboms | ||
| some annotation in s.annotations |
There was a problem hiding this comment.
This indicates that the annotation key is at the top level of the sbom data. Is that right?
There was a problem hiding this comment.
I look at the requirements in the Jira and it seems like that's right.
simonbaird
left a comment
simonbaird
left a comment
There was a problem hiding this comment.
I think it's good. Can you think of a way to test it on a real image with a real sbom that has an experimental Hermeto? The reporter might be able to share an image like that.
2 participants
Builds whose SBOM contains components fetched by an experimental Hermeto backend (hermeto:backend:experimental:*) now violate the release policy. Covers both SPDX and CycloneDX SBOM formats.
Issue: EC-1799
Co-Authored-By: Claude