coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: carry controlled SBOM source refs
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 20s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
This commit is contained in:
tegwick 2026-08-22 23:57:48 +02:00
parent 04c0535a61
commit e6901705be
5 changed files with 153 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

11
activity-definitions/daily-sbom-catchup.md
View file

@ -44,7 +44,7 @@ Context source `sbom-nexus / catch_up` (`context_resolvers/sbom_nexus.py`):
| --- | --- |
| input | `{"limit": 3}` |
| output | `{repos, selected_count, stale_count, never_count, total_count, limit}` |
| each repo | `repo_slug`, `last_sbom_at`, `sbom_age_days`, `has_sbom`, `checkout_available` |
| each repo | `repo_slug`, `last_sbom_at`, `sbom_age_days`, `has_sbom`, `checkout_available`, optional immutable `source_ref` |
Ranking (never-scanned first, then oldest `last_sbom_at`) belongs to
sbom-nexus. The adapter truncates to `limit` so an over-long response can never
@ -79,6 +79,10 @@ The progress event names the repos selected, updated, and skipped with a
reason (`no-checkout`, `no-manifest`, `ingest-error`), plus the fleet counters
so `never_count` can be watched declining day over day.
Controlled-source outcomes additionally include `source-unavailable` and
`source-rejected`. They remain terminal for the selected repository and never
cause the same fire to select a replacement target.
## Bounded side-effect (ACTIVITY-WP-0030-T02 / ACTIVITY-WP-0033)
`params.apply: true` declares the write, but context resolution remains
@ -98,6 +102,11 @@ and Activity Core's next heartbeat. The resulting `updated` and `skipped`
arrays are part of the run context and progress report. There is no task or
issue emission.
When Nexus returns a `forgejo-archive-v1` `source_ref`, the workflow freezes it
with the original target set and sends that exact object in the ingest body.
Retries reuse the same full commit SHA even if the repository default branch
has advanced.
## Enable checklist
1. CUST-WP-0062-T02/T03 done: `sbom-nexus` stood up, `GET /sbom/catch-up`