#202: SBOM and license report in CI #258

Merged

fable-5 merged 1 commits from feat/202-sbom-license-report into main 2026-07-31 04:51:41 +02:00

Conversation 0 Commits 1 Files Changed 6 +170 -1

fable-5 commented 2026-07-31 04:22:13 +02:00

Collaborator

Copy Link

Stacked on #257 (#236) — reduces to one commit after its merge. Issue #202.

• Release run generates CycloneDX 1.6 SBOMs via pinned anchore/syft:v1.33.0 — one per released image (from the built image tar, OS packages included) and one for the pnpm workspace (from the lockfile) — plus the full pnpm licenses report; all attached as supply-chain-vX.Y.Z build artefacts BEFORE the release publishes (red gate stops the release).
• Runner constraints (documented in the workflow comment): job talks to the HOST daemon, so no bind mounts — files enter the syft container via docker cp, images via docker save to a tar copied the same way (syft cannot read tar from stdin; verified).
• License policy lives in scripts/check-licenses.mjs: permissive allowlist + MPL-2.0/CC-BY-4.0 with recorded reasoning + per-package exceptions (khroma ships the MIT text but omits the metadata field). CI runs the gate on every PR; local pnpm licenses:check.
• Locally verified: gate positive (1125 packages green) and negative (fabricated GPL fails), workspace SBOM (1382 components) and image SBOM (1047 components) generated against real inputs.
• Provenance/regeneration documented in security.md §Supply chain artefacts; SBOM publication note for #228 follows as issue comment after merge.

Stacked on #257 (#236) — reduces to one commit after its merge. Issue #202. - Release run generates CycloneDX 1.6 SBOMs via pinned anchore/syft:v1.33.0 — one per released image (from the built image tar, OS packages included) and one for the pnpm workspace (from the lockfile) — plus the full pnpm licenses report; all attached as `supply-chain-vX.Y.Z` build artefacts BEFORE the release publishes (red gate stops the release). - Runner constraints (documented in the workflow comment): job talks to the HOST daemon, so no bind mounts — files enter the syft container via `docker cp`, images via `docker save` to a tar copied the same way (syft cannot read tar from stdin; verified). - License policy lives in `scripts/check-licenses.mjs`: permissive allowlist + MPL-2.0/CC-BY-4.0 with recorded reasoning + per-package exceptions (khroma ships the MIT text but omits the metadata field). CI runs the gate on every PR; local `pnpm licenses:check`. - Locally verified: gate positive (1125 packages green) and negative (fabricated GPL fails), workspace SBOM (1382 components) and image SBOM (1047 components) generated against real inputs. - Provenance/regeneration documented in security.md §Supply chain artefacts; SBOM publication note for #228 follows as issue comment after merge.

fable-5 added 3 commits 2026-07-31 04:22:13 +02:00

#236: pin the Node version ... 6a520e27b1

.node-version (22.15.1) becomes the single authoritative Node version:
CI/CD select Node only via node-version-file, every Dockerfile pins
node:22.15.1-alpine, and the engines floor in package.json states the
same version (open-ended upwards so a newer local Node keeps working —
reproducibility rests on images and CI). An early CI step fails on any
drift between those places; update procedure in operations.md
(Update strategy). Precondition for the reproducibility claim in #219.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#236: also pin the node helper images in workflows ... 9326177534

release.yml and drill.yml ran throwaway `docker run node:22.15-alpine`
helpers outside the pin; the drift check now also fails on any
node:<other>-alpine reference in .gitea/workflows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#202: SBOM and license report in CI ... d3289b2167

The release run now generates CycloneDX 1.6 SBOMs with a pinned
anchore/syft container — one per released image (scanned from the
freshly built image tar, OS packages included) and one for the pnpm
workspace (from the lockfile) — plus the full pnpm licenses report, and
attaches everything as build artefacts BEFORE publishing the release,
so a red gate stops the release. Runner constraints dictated the
mechanics (documented in the workflow): the job talks to the HOST
daemon, so files travel into the syft container via docker cp and
images via docker save to a tar copied the same way (syft cannot read
a tar from stdin — verified).

scripts/check-licenses.mjs is the documented license policy: permissive
allowlist, MPL-2.0/CC-BY-4.0 with recorded reasoning, per-package
exception table (khroma: MIT text shipped, metadata missing). CI runs
the gate on every PR (pnpm licenses:check); positive and negative case
tested locally, both SBOM paths tested against real images/lockfile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 referenced this pull request 2026-07-31 04:32:42 +02:00

#199: SHA-256 integrity hashes for attachments #259

fable-5 referenced this pull request 2026-07-31 04:33:22 +02:00

[VS-NfD] Write the security documentation (architecture, data flows, network plan, ports, trust boundaries) #228

fable-5 referenced this pull request 2026-07-31 04:42:59 +02:00

#200: hard instance-wide plugins.enabled kill switch #260

fable-5 referenced this pull request 2026-07-31 04:51:21 +02:00

#201: stable audit event catalogue for syslog/SIEM export #261

fable-5 merged commit d3289b2167 into main 2026-07-31 04:51:41 +02:00

fable-5 referenced this pull request 2026-07-31 04:52:10 +02:00

[VS-NfD] Produce an SBOM and a license report in CI #202

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

  

area:docs

  

area:export

  

area:ops

  

area:storage

  

area:supply-chain

  

auth

Authentication, permissions, quotas

  

backend

API server (apps/api)

  

blocked

Blocked on external dependency/infrastructure

  

collab

Collaboration server (apps/collab)

  

deployment

Docker, CI/CD, hosting

  

docs

Documentation

  

effort:L

  

effort:M

  

effort:S

  

frontend

SPA (apps/web)

  

plugins

Plugin system and SDK

  

qa

Tests, fixtures, e2e

  

vs-nfd

  

vs-nfd:blocker

No Label

area:auth

area:docs

area:export

area:ops

area:storage

area:supply-chain

auth

backend

blocked

collab

deployment

docs

effort:L

effort:M

effort:S

frontend

plugins

qa

vs-nfd

vs-nfd:blocker

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#258

No description provided.