chore: supply chain security (attestation, SBOM, Renovate)#93
chore: supply chain security (attestation, SBOM, Renovate)#93
Conversation
Adds attest job to release-please workflow providing SLSA L3 build provenance and a merged Python+Rust CycloneDX SBOM attestation. Publish job now gates on attest completing.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 51 minutes and 18 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Both test_get_expired_ttl and test_exists_expired_ttl used time.sleep() to wait for expiry, which is inherently flaky on loaded CI runners. Mock time.time() to advance 10s instead — deterministic, instant, zero flake risk.
1 participant
Summary
Changes
release-please.yml: Newattestjob (provenance + merged SBOM). Publish now depends on attest. All attestation steps soft-fail (continue-on-error: true).dependabot.yml: Deleted (replaced by Renovate)renovate.json: Added (extendsgithub>cachekit-io/renovate-config)attestation-check.yml: New weekly cron to verify attestations existTest plan
gh attestation verifysucceeds after next release