Repository navigation
Add Cargo SBOM and opt-in runtime-image source assurance - #17
Merged
firegrass merged 1 commit intoOct 8, 2026
Merged
Conversation
Packet: BKLG-20261008-7dyo. Implements ADR-0106 source inspectability with deterministic Cargo SBOMs and opt-in source-digest/sbom-path workflow outputs. ADR-0159 permits the necessary companion regression tests outside the declared intent scope.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cargo-only applications can now generate a deterministic CycloneDX SBOM from
Cargo.lock. The Cargo runtime-image workflow gains optionalsource-assurance: trueand exposes the verified SBOM path and git-tree source digest for ADR-0106 Marketplace evidence. The input defaults to false; pnpm SBOM bytes and the disabled image job graph are unchanged.The action also handles the default repository-root directory and rejects untracked or staged stale SBOMs. Regression tests cover registry/path/git crates, lockfile selection, deterministic bytes, workflow outputs, and actual action execution. README and CHANGELOG document the contract.
Validation passed on clean commit
6597d690093d11dcf25dde34b15ef1790d1a6298, tree970bfd06da051972d4291635310058b59053ffac: frozen pnpm install, typecheck, 44 TypeScript tests, 10 Python tests, Python compileall, and check:dist. Independent review approved this exact tree and verified the original pnpm-byte and disabled-job baselines.Packet: BKLG-20261008-7dyo. This is queued for the next v2 minor release; the workflow uses the released source-assurance action at
@v2, so the tag must advance before Cargo callers enable the input. No tags or public availability claims are changed here; public documentation follows the release through its owner workflow.