feat(python-sbom): add OSV-Scanner SBOM-ingest gate + nightly schedule (#152)#179
Conversation
… follow-up) Item 2: adds scan-runtime-osv job to python-sbom.yml that ingests the shared SBOM artifact via --sbom flag (no second resolver pass). Runs in parallel with Trivy and Grype; gating by default, controlled by new run-osv boolean input. Emits SARIF to the Security tab under category osv-sbom-runtime-deps. Reuses the same google/osv-scanner-action SHA already pinned in python-security-analysis.yml. Item 3: adds sbom-nightly.yml org-level workflow with a daily schedule trigger (02:17 UTC) and workflow_dispatch. Calls python-sbom.yml via same-repo relative path so the nightly run exercises the full pipeline. Skips cleanly in .github repo (no pyproject.toml); serves as reference pattern for downstream repos that need nightly CVE database coverage between PR builds. https://claude.ai/code/session_01JLmscfrMv91Qn8HMNM85Dk
|
Warning Review limit reached
More reviews will be available in 54 minutes and 22 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…update Two gaps surfaced during PR completeness audit: 1. CHANGELOG.md - the `[Unreleased]` section already documented the Grype addition (PR #169) but had no entry for the OSV-Scanner SBOM-ingest gate added in the parent cherry-pick. Adds an Unreleased > Added entry that mirrors the Grype precedent: input contract, gating semantics, SARIF category, no-new-third-party-surface note, and caller back-compat statement. Also documents `sbom-nightly.yml` as the org-level nightly reference pattern downstream repos can paste into their own caller workflows. 2. workflow-templates/python-sbom.yml - the template that gets copied into new repos via the GitHub Actions UI template picker. Its header comment still said "Scans for vulnerabilities with Trivy" - outdated since PR #169 (Grype) and now this PR (OSV-Scanner). Updates the header to enumerate all three scanners and adds an "Optional toggles" block surfacing `run-osv` and `grype-config-path` so downstream adopters discover them without spelunking the reusable workflow definition. No behavior change. CHANGELOG and header text only.
|
2 participants
Summary
Salvages two pieces of work from orphan branch
claude/sbom-cve-scanning-rWh7I(commitdf2cf51, never opened as a PR) that are not in main:scan-runtime-osvjob inpython-sbom.yml: OSV-Scanner consumes the sharedsbom-runtime.jsonartifact in parallel with Trivy and Grype. Same workflow, three scanners, one SBOM resolver pass. Reuses the OSV-Scanner SHA already pinned inpython-security-analysis.yml(9a498708...v2.3.8), so no new dependency surface. New SARIF categoryosv-sbom-runtime-deps.sbom-nightly.yml: org-level nightly workflow (02:17 UTC +workflow_dispatch) that callspython-sbom.ymlvia same-repo relative path. Skips cleanly in.github(nopyproject.toml); serves as reference pattern for downstream repos.Relationship to #152
#152's acceptance criteria cover the Trivy to Grype migration, which shipped in PR #169 (parallel-run mode). This PR layers OSV-Scanner on top as a complementary fast keyless gate. This is scope-expansion beyond #152's stated AC. If the maintainer prefers, this can split into its own tracking issue before merge.
Behavior change to flag
The new
run-osvworkflow input defaults totrue, which makes OSV-Scanner gating by default for every fleet repo that callspython-sbom.ymlon its next run. If that default is too aggressive for a soft launch, flip tofalseand have a follow-up enable per repo.Provenance
Cherry-picked from
origin/claude/sbom-cve-scanning-rWh7I@df2cf51onto a clean branch fromorigin/main. The orphan branch will be deleted after this PR lands.Test plan
osv-sbom-runtime-depscategory appears in Security > Code scanning alerts on first PR runsbom-nightly.ymlskips cleanly in.githubrepo (nopyproject.toml)workflow_dispatchtest against this branch viauses:overriderun-osv: falseopt-out path still leaves Trivy and Grype gating intactGenerated with Claude Code