chore: refresh org SBOM inventory

[opencode-agent]

Automated central SBOM inventory refresh for live non-fork repositories. Review reciprocal, restricted, and NOASSERTION license evidence in docs/sbom/inventory.md against the product's actual distribution and hosted-service model.

---

Current blocking state (2026-09-08)

• Exact head: e6b292ce5e104212eaa032579afff1514b865019; live main comparison is ahead 70 / behind 0. The effective customer-evidence delta remains docs/sbom/inventory.json and docs/sbom/inventory.md.
• required-workflow-bootstrap is deterministically RED before policy analysis because the Contents API does not inline the 1,148,611-byte JSON and protected main's policy caps that evidence path at 1 MiB. This is not an Nginx finding.
• Canonical owner repair #1946 sits at exact head 1cb8cceb8719eb054979d84141cda9a95c0c6873, ahead 5 / behind 0, with bounded Git Blobs fallback plus malicious-content and malformed-evidence tests. Both original and Ready-event same-head Security, SAST, Python Security, and CodeQL PR runs are terminal GREEN. Noema and Strix were materialized but failed on central orchestrator/free availability (HTTP 429 / zero ready routes); OpenCode's derived CHANGES_REQUESTED contains no leaf-source finding. Keep this inventory PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protected main, this branch non-force integrates that release, and new exact-head checks plus independent review are valid.
• Noema's orchestrator/free HTTP 429 is a separate review-transport blocker. Keep this PR Draft until fix(pingora): read Contents-API-oversized files through the Git Blobs API #1946 reaches protected main, this branch non-force integrates that release, and all new exact-head checks plus independent review are valid.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 3 potential issues.

⚠️ 3 issues in files not directly in the diff

⚠️ Partial inventory appears complete

With 34 of 63 SBOM fetches returning 404, repo_count reports all 63 while component totals cover only 29. The inventory presents partial organization evidence as complete.

---

⚠️ Permitted licenses trigger violations

For MPL-2.0 components without another prohibited license, flagged reports at least 137 policy violations. Governance therefore escalates expressly permitted dependencies.

---

⚠️ Permissive alternatives trigger violations

When an SPDX expression offers a permissive alternative, flagged rejects it because another alternative is copyleft. Seven selectable permissive dependencies become policy violations.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

⚠️ 1 issue in files not directly in the diff

⚠️ Restricted licenses escape policy review

Seven LicenseRef-NVIDIA-Proprietary components are marked unflagged. Unknown and non-standard licenses also disappear from the commercial-permissive policy review.

[seonghobae]

Diagnosis of the required-workflow-bootstrap failure on this branch (run 33989047645, 5 s, exit 2):

Pingora edge policy could not establish complete evidence: GitHub content evidence for docs/sbom/inventory.json exceeds the size contract

This is deterministic and content-blind, not an Nginx finding. The regenerated docs/sbom/inventory.json is 1,148,611 bytes (236 bytes on main). GitHub omits the diff patch for a file that large, .json is neither a documentation suffix nor a binary document format, so pingora_edge_policy.py must fetch the content, and the Contents API stops inlining at 1 MiB (encoding: "none"), which the policy turns into a fail-closed ContentSizeExceededError. Scanned offline with main's own scan_content, the file has zero denied forms and does not contain the string nginx at all. Every push of this branch will hit the same wall until the evidence route changes.

Fix: #1946 makes the policy follow the Contents response's blob sha to the Git Blobs API (bounded at 11 MiB, bound back to the same sha and size) and scan the bytes like any inline file. Once it is on main, one push that merges main into this branch re-binds the required workflow's trusted source and this context can pass on its merits; re-running the job before then reproduces the same exit 2.

---

Generated by Claude Code

[cwl-noema-review]

Noema LLM review

The PR refreshes several workflow concurrency groups, adds a coordinator job for CodeQL dispatch, improves allowlist parsing to support multiple trusted actors, and enhances audit coverage reporting. The changes are consistent with the stated rationales, preserve the existing authorization invariants, and introduce no confirmed concrete regressions.

Reviewed changed lines

• .github/workflows/agent-mention-noema-dispatch.yml:17 (RIGHT): Moves concurrency from the job level to workflow level. The workflow has a single job and the job-level block is removed, so there is no same-group self-wait risk and queued runs coalesce earlier.
• .github/workflows/agent-mention-opencode-dispatch.yml:17 (RIGHT): Moves concurrency from the job level to workflow level. The workflow has a single job and the job-level block is removed, so there is no same-group self-wait risk and queued runs coalesce earlier.
• .github/workflows/codeql-scan-dispatch.yml:157 (RIGHT): Parses ALLOWED_DISPATCH_ACTOR as a comma-separated allowlist while requiring non-empty actors; an empty allowlist continues to admit nothing.
• .github/workflows/codeql-scan-dispatch.yml:524 (RIGHT): The wake job condition reads validated output required_jobs and only proceeds when non-empty, avoiding a wake with missing job bindings.
• .github/workflows/opencode-review-dispatch.yml:150 (RIGHT): Uses the same comma-separated allowlist parsing with a non-empty guard, permitting multiple trusted dispatch identities without weakening empty-list denial.

Adversarial validation

• .github/workflows/agent-mention-noema-dispatch.yml:17 (RIGHT) falsified: Moving concurrency to workflow level could cause a run to wait on its own group when job-level and workflow-level groups match. — The diff removes the job-level concurrency block entirely, leaving only the workflow-level group, so no job requests the group its own run already holds.
• .github/workflows/agent-mention-opencode-dispatch.yml:17 (RIGHT) falsified: Moving concurrency to workflow level could cause a run to wait on its own group when job-level and workflow-level groups match. — The diff removes the job-level concurrency block entirely, leaving only the workflow-level group, so no job requests the group its own run already holds.
• .github/workflows/codeql-scan-dispatch.yml:157 (RIGHT) falsified: Parsing ALLOWED_DISPATCH_ACTOR with IFS=',' could produce an empty actor that is admitted. — The loop checks allowed_actor is non-empty before comparing against DISPATCH_ACTOR and DISPATCH_SENDER, so an empty allowlist admits nothing.
• .github/workflows/codeql-scan-dispatch.yml:524 (RIGHT) falsified: Using validated output required_jobs in the wake condition could let a wake job run when no valid job ids were bound. — The wake job condition explicitly requires needs.validate-dispatch.outputs.required_jobs != '', preventing an empty jobs list from triggering the job.
• .github/workflows/opencode-review-dispatch.yml:150 (RIGHT) falsified: Parsing ALLOWED_DISPATCH_ACTOR with IFS=',' could produce an empty actor that is admitted. — The loop checks allowed_actor is non-empty before comparing against DISPATCH_ACTOR and DISPATCH_SENDER, so an empty allowlist admits nothing.
• Residual risk: Low. The audited probes attempted concrete regressions around deadlocks, empty allowlists, and malformed job wake inputs and were all falsified against the changed lines.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 5f264b19eea2559b4d8ce765e158d7d414bf90eb
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[opencode-agent]

OpenCode Review Overview

• Head SHA: ceea8ab13058fd2d9dcfa2d02bf563e61777169e
• Workflow run: 34194023190
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a996b1b5-fe43-4d90-80a8-cc5dbde92b6f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}