fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base

[seonghobae]

What

.github/workflows/sbom-generation.yml:

• add push: branches: [main, master, develop] so default-branch commits get a dependency snapshot;
• change the concurrency group's final fallback from github.ref to github.sha;
• add a dedicated static contract test that pins the push trigger, commit-SHA concurrency key, dependency snapshot submission, write permission, and closed-PR job conditions.

Why

dependency-review compares the base and head dependency graphs. SBOM Generation only ran on pull_request and release, so main never received a dependency snapshot and every PR's comparison reports:

The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match

With no base snapshot the action treats the entire dependency set as newly added, so it re-flags every pre-existing vulnerability on every PR instead of only the ones the PR introduces. This was observed on #733 and #734.

This does not weaken the gate: genuinely added vulnerable dependencies still fail, while whole-repository scanners (trivy-fs, pip-audit) continue to catch pre-existing findings. It restores the intended diff-scoped semantics of dependency-review.

Why the concurrency fallback changes

For pull requests the group is keyed by PR number and for releases by tag. Push events need a commit-specific final key. Using github.ref would make every push to main share one concurrency group; with cancel-in-progress: true, a later commit could cancel the earlier commit's dependency submission and recreate the missing-base snapshot defect. github.sha preserves one snapshot attempt per commit while still deduplicating reruns of the same commit.

Verification contracts

tests/test_sbom_generation_push_contract.py proves:

• main, master, and develop pushes are included;
• pull-request and release triggers remain present;
• SPDX generation still submits dependency-snapshot: true;
• push concurrency falls back to github.sha, never github.ref;
• closed PRs only run the cancellation sentinel;
• push and release events run generate-sbom with job-scoped contents: write.

Current-head GitHub Actions remain authoritative before merge. The first successful push run after this lands populates the default-branch snapshot used by subsequent PR comparisons.

Related

The genuine Strix lock advisories and explicit aiohttp floor are now folded into atomic baseline PR #731. This PR addresses the independent missing-base-snapshot root cause.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 85ceaf4a-9c3b-4125-9912-207a303dca0f

📥 Commits

Reviewing files that changed from the base of the PR and between 3f65dbe and 1b5dbeb.

📒 Files selected for processing (2)

• .github/workflows/sbom-generation.yml
• tests/test_sbom_generation_push_contract.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head diagnosis: the new SBOM push contract is not the failing component. CodeQL, Semgrep, Secret Scan, Scorecard, OSV and SBOM all pass; Python Security and Security Scan fail only on the protected main Strix lock (aiohttp==3.14.1, cryptography==49.0.0). Atomic baseline PR #731 carries the exact fixes plus the explicit aiohttp>=3.14.3 floor. Keep this PR ready and auto-merge queued; after #731 lands, update/retest this same branch so the first default-branch push can populate the missing dependency snapshot.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de.

• Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de

• Workflow run: 30897835687

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sbom-generation.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_sbom_generation_push_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_sbom_generation_push_contract.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de
• Workflow run: 30899990370
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de.

• Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de

• Workflow run: 30899990370

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sbom-generation.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_sbom_generation_push_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_sbom_generation_push_contract.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de.

• Head SHA: 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de

• Workflow run: 30899990370

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sbom-generation.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_sbom_generation_push_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_sbom_generation_push_contract.py"]
  R2 --> V2["targeted test run"]

Loading

[seonghobae]

@opencode-agent Please re-review exact head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de after central baseline PR #731 lands and current-head coverage evidence reruns. Verify the default-branch dependency snapshot trigger, commit-SHA concurrency key, least-privilege write scope, and closed-PR conditions. Submit APPROVE only if exact-head checks pass and no blocking finding remains.

[seonghobae]

@cwl-noema-review Please independently review exact head 1b5dbebbc93fd4b9aafedafb22ee1679ed4ee7de after #731 repairs the central baseline and current-head checks complete. Confirm the dependency-snapshot workflow remains fail-closed and submit APPROVE only if no blocker remains.

[seonghobae]

Superseded by #731 exact head 0b6a188ab1a6e96b8450c47c7d5313c4c708fd39, which now contains this two-file default-branch SBOM dependency-snapshot repair together with the inseparable central CodeQL, Strix-lock, and coverage-deadlock baseline. Keeping a second open PR would duplicate checks and create an ambiguous merge order.