coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement bounded SBOM Nexus catch-up
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 23s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
This commit is contained in:
tegwick 2026-08-22 20:45:02 +02:00
parent 192f74f678
commit 8e8c74bd4c
3 changed files with 221 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

24
activity-definitions/daily-sbom-catchup.md
View file

@ -16,6 +16,7 @@ context_sources:
required: true
params:
limit: 3 # catch_up_limit — operator knob, not a nexus constant
apply: true # declared bounded side-effect; manual runs require confirmation
bind_to: context.catchup
# One ranked call returns only the N repos that have lacked a current SBOM the
# longest (never-scanned first) plus fleet counts. There is deliberately no
@ -24,10 +25,9 @@ context_sources:
# Daily SBOM Catch-up
> **Disabled until CUST-WP-0062-T03 lands.** The `sbom-nexus` catch-up API does
> not exist yet; the resolver contract is exercised against a test double in
> `tests/test_sbom_nexus_context_resolver.py`. Do not enable this schedule
> against the old per-repo `/sbom/{slug}` walk (CUST-WP-0062-T05).
> **Disabled until production enable evidence is ready.** The `sbom-nexus`
> ranked and terminal ingest/skip APIs are now available. Keep this definition
> off until cluster reachability and a bounded manual fire are proven.
Replaces `weekly-sbom-staleness` / `flag-stale-sbom` (ACTIVITY-WP-0030).
The weekly check reported the backlog — 111 / 111 repos stale on 2026-08-18,
@ -79,18 +79,20 @@ The progress event names the repos selected, updated, and skipped with a
reason (`no-checkout`, `no-manifest`, `ingest-error`), plus the fleet counters
so `never_count` can be watched declining day over day.
## Not yet implemented (ACTIVITY-WP-0030-T02)
## Bounded side-effect (ACTIVITY-WP-0030-T02)
The bounded ingest side-effect — calling sbom-nexus ingest for each of the N
selected repos using the registered checkout — waits on CUST-WP-0062-T03. Until
then this definition resolves and reports only. When T02 lands, a recorded skip
must advance the queue position so an impossible repo does not permanently head
it.
`params.apply: true` calls sbom-nexus for each of the already-truncated N
targets. A target with an explicitly unavailable checkout is recorded through
`POST /sbom/{slug}/skip` as `no-checkout`; other targets use the terminal ingest
route, which returns `ingested`, `no-manifest`, or `ingest-error`. Transport and
contract failures are recorded as `ingest-error`. The resulting `updated` and
`skipped` arrays are part of the run context and progress report. There is no
task or issue emission.
## Enable checklist
1. CUST-WP-0062-T02/T03 done: `sbom-nexus` stood up, `GET /sbom/catch-up`
returns oldest-N in one call.
returns oldest-N in one call. **Done 2026-08-22.**
2. `SBOM_NEXUS_URL` reachable from the railiance01 worker.
3. ACTIVITY-WP-0030-T02 ingest side-effect implemented and dry-run proven.
4. `weekly-sbom-staleness` confirmed off in source **and** production