fix(ci): SOC2 gitleaks + CycloneDX SBOM with PR #94 reviewer remediations#115
Conversation
…CC9.2) - Step 12: wire gitleaks/gitleaks-action@v2 against existing .gitleaks.toml (gitguardian.yml is soft-skip when GITGUARDIAN_API_KEY unset — not a CC6.1 replacement) - Step 13: add CycloneDX SBOM job to supply-chain.yml with GPL/AGPL hard-fail audit (supply-chain.yml had pip-licenses + dependency-review but no SBOM artifact generation) SOC 2 controls satisfied: CC6.1: Gitleaks blocks merge on secret detection — no soft-skip path CC9.2: CycloneDX JSON SBOM generated + GPL/AGPL audited + retained 90 days on main push l9-implementer-marker:v1
Addresses two reviewer comments on PR #94: - P1: substring 'gpl' falsely matched 'lgpl' — replaced with exact SPDX token set {GPL-2.0, GPL-3.0, AGPL-3.0, AGPL-1.0} using word-boundary tokenisation; LGPL no longer triggers the gate - P2: audit missed licenses[].license.name field — all three CycloneDX license representations now checked: expression, license.id, license.name Version bumped to 1.1.1.
Align the new gitleaks workflow with the repo-wide fix (commit dca598b): expressions are not evaluated in the on: key and cause a startup failure with zero jobs. Replace with literal main. Co-authored-by: Cursor <cursoragent@cursor.com>
Addresses reviewer feedback on the SOC 2 Gitleaks/CycloneDX PR and fixes a pre-existing pip-licenses tooling-drift failure in the same workflow file. gitleaks.yml: - Add `develop` to the push hard-gate trigger (objective gates main+develop) - persist-credentials:false on checkout (scan-only job, no push access needed) supply-chain.yml (cyclonedx-sbom job): - Stop failing open on dependency install (removed `2>/dev/null ... || true`) so a failed project install fails the job instead of producing a bare-env SBOM - Pin cyclonedx-bom==7.3.0 for reproducible SBOMs - Detect spelled-out GPL/AGPL license names in licenses[].license.name while excluding LGPL / Lesser variants - persist-credentials:false on the SBOM checkout supply-chain.yml (license-compliance job, blocking failure): - pip-licenses dropped the `table` format; switch the three usages to `plain` Skipped (with reason): SHA-pinning actions/checkout — the entire repo uses the `@v6` tag convention across 20+ workflow files; pinning only these new files would be inconsistent and it is a non-blocking linter advisory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YRYnyUCsvjjscHTwuyiYfH
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
More reviews will be available in 59 minutes and 45 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Size Report
✅ PR size is within recommended limits |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7d869f095a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| persist-credentials: false # scan-only job — do not retain git push credentials | ||
|
|
||
| - name: Gitleaks scan | ||
| uses: gitleaks/gitleaks-action@f6d28b60c0e56e48b77e6e05ae47c3fc9b22e77f # v2.3.6 |
There was a problem hiding this comment.
This new hard gate will fail before scanning because the action ref is not resolvable: the upstream v2.3.6 release page shows commit 44c470f, while https://raw.githubusercontent.com/gitleaks/gitleaks-action/f6d28b60c0e56e48b77e6e05ae47c3fc9b22e77f/action.yml returns 404. In every PR/push that runs this workflow, Actions cannot download gitleaks/gitleaks-action@f6d28..., so the SOC2 secret-scan gate is broken until the ref is corrected.
Useful? React with 👍 / 👎.
| persist-credentials: false # scan-only job — do not retain git push credentials | ||
|
|
||
| - name: Gitleaks scan | ||
| uses: gitleaks/gitleaks-action@f6d28b60c0e56e48b77e6e05ae47c3fc9b22e77f # v2.3.6 |
There was a problem hiding this comment.
Even after correcting the SHA, v2.3.6 is a Node 20 action (action.yml has runs: using: "node20"), and the upstream gitleaks README says v3 is the Node 24 migration. Since GitHub-hosted runners switched Node 24 on by default in June 2026, this new blocking workflow has no ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out and can fail before the scan runs; pin a reviewed v3 SHA instead.
Useful? React with 👍 / 👎.
|
2 participants
Summary
Recovered from orphaned branch
claude/pr-94-remediation-rg9gx5(agent work that had no PR and was never merged). Do not merge without review.This is effectively a more complete successor to PR #94 (
fix/soc2-gitleaks-cyclonedx-sbom): it contains #94's content plus reviewer-comment remediations and the literal-branchon:fix already applied to main.Changes vs
main:.github/workflows/gitleaks.yml: Gitleaks hard gate; action pinned to a full commit SHA; literal- maininon:trigger (no${{ }}expression — avoids startup failure)..github/workflows/supply-chain.yml: CycloneDX SBOM generation + exact SPDX-token GPL/AGPL license-compliance gate (SOC 2 CC6.1/CC9.2).Relationship to PR #94
d4d848ac(original SOC2 work),5b174660(exact SPDX matching),adf49d14(pin gitleaks SHA),03d0d743(gitleakson:literal-branch fix), and7d869f09(reviewer-comment remediation + license gate).Test plan
Made with Cursor