coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close daily SBOM catch-up workplan
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 21:06:01 +02:00
parent c2f797f8d5
commit 28696b3238
3 changed files with 92 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

38
workplans/ACTIVITY-WP-0030-daily-sbom-catchup.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Daily bounded SBOM catch-up via sbom-nexus"
domain: infotech
repo: activity-core
status: active
status: done
owner: grok
topic_slug: infotech
created: "2026-08-18"
updated: "2026-08-21"
updated: "2026-08-22"
parent_workplan: CUST-WP-0062
related:
- CUST-WP-0062
@ -96,7 +96,7 @@ there is no live nexus yet and the definition stays `enabled: false`:
```task
id: ACTIVITY-WP-0030-T02
status: wait
status: done
priority: high
state_hub_task_id: "0d09c0d3-74bd-4f4d-8b27-5006ba010fa3"
```
@ -108,11 +108,17 @@ in the run artefact and progress event. Do not spawn Forgejo issues
(ACTIVITY-WP-0022). Do not retry a recorded skip as if it were still the
oldest never-scanned repo.
Done 2026-08-22 after SBOM-WP-0002 delivered the live Nexus contracts. The
resolver truncates before writes, uses explicit `apply: true`, records
`no-checkout` directly, and turns ingest/transport failures into terminal
`ingest-error` skips. Focused coverage proves read-only default behavior,
success, skip, error, and at-most-N processing.
### Retire weekly task flood
```task
id: ACTIVITY-WP-0030-T03
status: progress
status: done
priority: high
state_hub_task_id: "18bcfc21-616a-48a2-aac3-cdcef7579913"
```
@ -124,11 +130,15 @@ if it no longer emits one task per repo. After the daily job is proven on
railiance01, update the runbook / playbook and prove one Monday window with zero
SBOM task spawns and a successful daily catch-up the same week.
Done 2026-08-22: production inventory shows `weekly-sbom-staleness` disabled
and its Temporal schedule paused while `daily-sbom-catchup` is enabled and
active. Both production proof fires spawned zero tasks.
### Prod enable and evidence
```task
id: ACTIVITY-WP-0030-T04
status: wait
status: done
priority: medium
state_hub_task_id: "f09144f6-c7f9-41d4-b466-d8a6288e6a21"
```
@ -138,10 +148,18 @@ and capture prod evidence via `./scripts/prod_automation_status.sh` plus the
`sbom_catchup` progress event. Confirm `tasks_spawned` is 0 and N updates
(or documented skips) appear per fire.
Done 2026-08-22. The Railiance ConfigMap projection is enabled with limit 3,
`SBOM_NEXUS_URL` points to the in-cluster service, and the Nexus NetworkPolicy
admits only the declared Activity Core caller in addition to State Hub. Two
manual production fires processed six distinct repositories as terminal
`no-checkout` skips, emitted two `sbom_catchup` progress events, and spawned
zero tasks. See
`docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md`.
## Acceptance
- [ ] Daily definition exists; weekly flood is off
- [ ] Evaluation is one sbom-nexus catch-up call
- [ ] Each fire updates at most N repos (default 3)
- [ ] Progress names the repos and skip reasons
- [ ] Railiance01 evidence for at least two successful daily fires
- [x] Daily definition exists; weekly flood is off
- [x] Evaluation is one sbom-nexus catch-up call
- [x] Each fire updates at most N repos (default 3)
- [x] Progress names the repos and skip reasons
- [x] Railiance01 evidence for at least two successful daily fires