ci: generate and publish Python SBOM (.cdx.json) alongside wheel/tar.gz#1171
ci: generate and publish Python SBOM (.cdx.json) alongside wheel/tar.gz#1171
Conversation
- In build.yml build-whl: install built wheel + cyclonedx-bom, run cyclonedx-py environment to produce dfetch-VERSION-py.cdx.json in dist/; the existing release job uploads dist/* so the SBOM is automatically attached to the GitHub release draft. - In python-publish.yml build: same generation but SBOM goes into dist-sbom/ (separate from dist/) to keep PyPI upload clean; stored as a python-sbom artifact. - In python-publish.yml deploy: downloads the python-sbom artifact and attaches it to the published GitHub release via softprops/action-gh-release; adds contents: write permission. https://claude.ai/code/session_01VPK44jamDeLp4Tcy916XDT
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe pull request modifies CI workflows and a build script to integrate SBOM (Software Bill of Materials) generation for Python distributions. It switches dependency installation to use project extras, adds new SBOM generation steps in CI, and extends the SBOM creation script with command-line options to support both Python and platform-specific package formats. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 50 minutes and 13 seconds.Comment |
Extend script/create_sbom.py with a --py flag and an optional --output-dir argument so the Python distribution SBOM follows the same pattern as the binary one (pip install .[extra] then the script). - create_sbom.py: add parse_args(); --py uses suffix "py" and defaults output to dist/; --output-dir overrides the directory for both modes - pyproject.toml: add wheel = ["build==1.2.2"] optional dependency so the build frontend is pinned alongside the rest of the toolchain - build.yml build-whl: replace pip install + inline cyclonedx invocation with pip install .[wheel] + python script/create_sbom.py --py - python-publish.yml build: same, passing --output-dir dist-sbom to keep the SBOM out of dist/ so PyPI upload stays clean https://claude.ai/code/session_01VPK44jamDeLp4Tcy916XDT
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/python-publish.yml:
- Around line 101-114: The publish-to-PyPI step ("Publish distribution 📦 to
PyPI" that uses pypa/gh-action-pypi-publish@...) makes the workflow
non-idempotent because subsequent SBOM upload steps (e.g., "Upload SBOM to
GitHub Release" using softprops/action-gh-release) can fail and block re-runs;
fix by either moving the PyPI publish step to run after the SBOM download/upload
steps, or make the pypa/gh-action-pypi-publish step idempotent by adding the
skip-existing option (set skip-existing: true under the publish step's with:
block) so re-runs won’t fail if the package version already exists.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d1bec0c2-828d-4687-88ea-30ad712508f2
📒 Files selected for processing (4)
.github/workflows/build.yml.github/workflows/python-publish.ymlpyproject.tomlscript/create_sbom.py
Add skip-existing: true to the production PyPI publish step in the deploy job, matching the existing testpypi job. Without this, if the SBOM download/upload steps after the publish step fail, a re-run would be blocked because PyPI rejects re-uploading an already-published version. https://claude.ai/code/session_01VPK44jamDeLp4Tcy916XDT
2 participants
cyclonedx-py environment to produce dfetch-VERSION-py.cdx.json in
dist/; the existing release job uploads dist/* so the SBOM is
automatically attached to the GitHub release draft.
dist-sbom/ (separate from dist/) to keep PyPI upload clean; stored
as a python-sbom artifact.
and attaches it to the published GitHub release via
softprops/action-gh-release; adds contents: write permission.
https://claude.ai/code/session_01VPK44jamDeLp4Tcy916XDT
Summary by CodeRabbit