fix(release): accept Syft root directory evidence - #775
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e39f4c7519
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
|
|
||
| def validate_image_path(value: Any, field: str) -> str: | ||
| def validate_image_path(value: Any, field: str, *, allow_root: bool = False) -> str: |
There was a problem hiding this comment.
The reviewed commit contains no Signed-off-by trailer, so it violates the repository's requirement that every commit use git commit -s and will be rejected by DCO enforcement. Recreate or squash this commit with a valid sign-off before merging.
AGENTS.md reference: AGENTS.md:L272-L275
Useful? React with 👍 / 👎.
1 participant
Summary
/only when parsing native Syft file evidence/in reviewed exposure-assertion pathsFailure reproduced
Release candidate run 31752330081 stopped safely because Syft 1.45.1 reports the actual image root as a directory at
/, while the checker classified/as non-normalized. Exact inspection of all three private candidate image digests found the same sole path-shape issue. No candidate bundle, tag, or public release was produced.Verification
python3 -m unittest release/scripts/test_check_advisory_baselines.py(45 passed, 1 platform skip)python3 -m unittest discover -s release/scripts -p "test_*.py"(360 passed, 1 platform skip)python3 release/scripts/check-gates-inventory.py(151 gates)actionlintgit diff --checkThe separate accepted-risk baseline rebind remains intentionally out of this PR and requires explicit security approval.