Repository navigation
feat(sbom): implement v1 dependency extraction from build.zig.zon - #5
Conversation
…yList) WHY: Cross-validation against the sibling-repo revision plans (synthfq, gitstore-cli) surfaced two 0.16-drift items in this repo that CodeRabbit's PR #1 threads never flagged, so R5 left them untouched. Both are the exact drift classes this template exists to police. WHAT: - doc/TIGER_STYLE_ZIG.md §1.4: argsAlloc row no longer claims the API is "unchanged"; right column now shows the Juicy Main pattern init.minimal.args.toSlice(init.arena.allocator()). - scripts/zig-fitness.zig (stack walk + escapeJsonString) and scripts/emit-sbom.zig (escapeJsonString): std.array_list.Managed replaced with unmanaged std.ArrayList (.empty, append(gpa, ...), deinit(gpa), toOwnedSlice(gpa)). IMPACT: docs + aux scripts only; no public API change (baseline OK); scripts/ now has zero std.array_list.Managed occurrences. VALIDATION: zig-fitness + emit-sbom compile for native and x86_64-windows-msvc; verify-commit OK (fmt, ast-check, zig build test, API baseline); bun test 15/15.
|
Warning Review limit reached
More reviews will be available in 4 hours, 58 minutes, and 31 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
https://github.com/EugOT/claude-zig-quality/blob/3fd4139ccae327863940e1657afa2c2d11ae87a0/scripts/emit-sbom.zig#L163
When a URL dependency has the normal Zig .hash value, this emits that value as a CycloneDX SHA-256 digest, but Zig hashes include the multihash prefix (1220 + the 64 hex SHA-256 bytes). The resulting 68-hex-character content is not a valid CycloneDX SHA-256 hash, and path-only dependencies currently emit an empty hash the same way, so verify-release can write an SBOM that schema validators reject as soon as dependencies are present.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Pull request overview
Implements v1 SBOM dependency extraction for build.zig.zon by replacing the prior stubbed dependency discovery with real std.zig.Ast-based traversal, and updates/expands inline tests to cover the new behavior and the fail-closed guard.
Changes:
- Implemented
findStructField/findStringFieldInStructusing.zonAST struct-init idioms to enumerate.dependencies. - Kept the “fail closed” behavior for declared-but-unwalkable
.dependenciesshapes and added a regression test for non-struct.dependencies. - Updated tests to validate emitted components for extracted dependencies.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
WHY: closes claude-zig-quality#3. The v0 emitter stubbed dependency extraction (findStructField returned null), so any manifest declaring .dependencies failed closed and no SBOM with components could ever be published. WHAT: real std.zig.Ast extraction using the stdlib's own zon idioms (rootDecls()[0] zon root, fullStructInit, firstToken(field)-2 name token — same as std/zon/parse.zig): - findStructField walks .dependencies and returns one DepEntry per declared dep (caller-freed slice; allocator now explicit). - findStringFieldInStruct extracts .url/.hash strings from each entry. - Fail-closed guard retained: a .dependencies value that is not a struct init still raises IncompleteSbom (new regression test). - Stub-era wording removed from SbomError doc and refusal log. IMPACT: emit-sbom now publishes CycloneDX components for declared dependencies; path-only deps appear with empty hash/url. No public API change (baseline OK). VALIDATION: TDD red->green; zig test scripts/emit-sbom.zig 4/4 (extraction, fail-closed, no-deps, JSON escaping); e2e run on the repo's own build.zig.zon emits valid CycloneDX; native + x86_64-windows-msvc compile; verify-commit OK; bun test 15/15.
3fd4139 to
b5ce2e6
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
Verified all 5 Copilot picks are addressed at HEAD (they were filed pre-refactor and are now marked outdated):
Build: 7/7 steps, 16/16 tests pass on |
Closes #3.
Summary
Replaces the v0 stubs (
findStructField,findStringFieldInStruct) with realstd.zig.Astextraction using the stdlib's own zon idioms —rootDecls()[0]zon root,fullStructInit, and thefirstToken(field) − 2field-name token (same pattern asstd/zon/parse.zig:1105):.hash+.url; path-only deps appear with empty hash/url.dependenciesvalue that is not a struct init still raisesIncompleteSbomfindStructField(caller frees entries); stub-era wording removed fromSbomErrordoc and the refusal logStacked on
fix/r6-cross-plan-gaps(#4) — retarget tomainautomatically when #4 merges.Test plan
zig test scripts/emit-sbom.zig4/4 (extraction, fail-closed, no-deps, JSON escaping)zig run scripts/emit-sbom.zig -- build.zig.zonemits valid CycloneDX for the repo's own manifestx86_64-windows-msvccompilebun scripts/verify-commit.tsOK (fmt, ast-check, zig build test, API baseline)bun test15/15