chore(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2

[dependabot]

Bumps anchore/sbom-action from 0.24.0 to 0.24.2.

Release notes

Sourced from anchore/sbom-action's releases.

v0.24.2

Added Features

• bump eslint from 10.8.1 to 10.9.0 [#724 @​dependabot]

Additional Changes

• add makefile target to bump syft [#620 @​willmurphyscode]
• update zizmor workflow triggers [#624 @​wagoodman]
• require zizmor security events [#621 @​wagoodman]

(Full Changelog)

Commits

• 3ad7283 ops: update write permissions for release (#723)
• 31f5287 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#724)
• aa80c8c chore(deps): update Syft to latest release (#722)
• 74b54e9 chore(deps): bump lodash from 4.17.23 to 4.18.1 (#623)
• 6b92ff5 chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#721)
• 4f8983b chore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (#719)
• 10f27f4 chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (#720)
• 249403a chore(deps-dev): bump @​types/node from 26.1.0 to 26.2.0 (#718)
• cbf8daa chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (#693)
• 6afc793 fix: pin syft install.sh to the release tag being installed (#716)
• Additional commits viewable in compare view

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for d0f2dfddc165fba5830a352218be0ee425e26078.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix workflow run: cancelled (https://github.com/ContextualWisdomLab/.github/actions/runs/33398933567)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: sbom-generation.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: sbom-generation.yml"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: d0f2dfddc165fba5830a352218be0ee425e26078
• Workflow run: 33426599979
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: chore(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 #1519 (review)

[seonghobae]

Update: the manual Strix rerun (attempt 2) was also cancelled within ~60s, not a one-off flake — strix.yml's concurrency group is scoped per-repository (not per-PR), so with this repo's current very high concurrent PR volume, a queued rerun keeps losing its single "pending" slot to another PR's dispatch before it can start. The workflow's own comments describe an automatic re-dispatch after such supersession, but none has been observed for this PR's head in 8+ hours (only the two attempts I've made). Recorded in ContextualWisdomLab/.github#1530 as an open, not-yet-root-caused scheduler gap.

Not re-running again per the drive-to-green protocol's one-attempt cap — will keep this PR watched and pick it back up once the repo's Strix queue has room, or if I find the specific gap in the re-dispatch logic.

---

Generated by Claude Code

[adflickinger213]

Helping Hand exact-head reconciliation — 2026-09-01

Fresh protected base is main@7b1a028e704a98ae8a807bb827f44aeaee0399af; this PR is open, non-draft, mergeable, unmerged, one commit / one changed file at exact head 65e0bc8051deecaaf001c983f220edbe63dcc8b8.

The effective current-head delta is bounded to two SHA/comment replacements in .github/workflows/sbom-generation.yml, moving both anchore/sbom-action uses from pinned v0.24.0 SHA e22c389904149dbc22b58101806040fa8d37a610 to pinned v0.24.2 SHA 3ad7283483fc7af8ff2b4ea19663c2d5ca935e26.

The existing OpenCode CHANGES_REQUESTED review is anchored to historical head d0f2dfddc165fba5830a352218be0ee425e26078 and cites a cancelled Strix run on that predecessor. It is historical evidence only and must not be inherited as a current-head verdict.

Fresh hosted runs have materialized on 65e0bc8; Security Scan, OSV-Scanner PR, Scorecard PR, SBOM Generation, Python Security, SAST Semgrep, Secret Scan, and CodeQL PR are currently queued. Queued/pending/predecessor evidence is non-passing; no workflow rerun was requested here.

Bounded waypoint: preserve this exact head and re-read terminal current-head evidence later. Merge/admission remains Heart-owned and is not authorized by this receipt.

[seonghobae]

Triage: coalesce failure on this PR is a base-repo CI race, not this PR's fault.

What coalesce is: .github/workflows/current-head-run-coalescer.yml runs scripts/ci/current_head_run_coalescer.py, a queue-dedup control-plane job that retires redundant queued Actions runs for one exact open PR head. It is not a functional test of this PR's diff.

Why it failed (job 100329784967):

CoalescingRefused: pull request head moved before duplicate classification

The script re-fetches the live PR head immediately before acting and refuses to proceed if it doesn't match the head it was invoked for (EXPECTED_HEAD=c13afeab8461d09255b3bbe0c0be62d9589edad6) — a deliberate safety check, not a bug in isolation. This PR's branch is auto-synced with main very frequently by the org's scheduler (5 "Merge branch 'main' into ..." commits in ~19h, most recently b5821d14… right around when this job ran), and the pre-fix version of this workflow had concurrency: cancel-in-progress: true keyed per-PR, so a push burst could invalidate an in-flight coalescer run's assumptions before it finished — exactly this failure mode.

This is already root-caused and fixed on main: bf28b5d — "fix(actions): let the current-head coalescer finish under push bursts" (#1769) flips that concurrency setting to cancel-in-progress: false and adds a regression test (test_current_head_coalescer_self_cancellation.py). That fix merged to main shortly before/around this job's execution; because this is a pull_request_target-style control-plane workflow, the run that failed executed against the base-repo script snapshot pinned at its own trigger time (pre-#1743-era HEAD 8c08583), i.e. before #1769 landed — not against the current, fixed main.

Checked for an analogous stale-reference bug (like #1517/#1518/#1521): searched this PR's full branch tree for the old anchore/sbom-action SHA/version (e22c389… / 0.24.0) — no leftover references anywhere. Both uses: lines in sbom-generation.yml are correctly and consistently updated to 3ad7283… / # v0.24.2. No fix needed in this PR's diff.

Conclusion: no code change pushed. A fresh coalesce run is already queued on the PR's current head and should run clean against the fixed base script. Other individual checks on this head (Devin Review) are green; the rest of the required-workflow set is queued behind this repo's normal CI backlog, unrelated to this PR's content.

---

Generated by Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[cwl-noema-review]

Noema LLM review

The PR correctly bumps the anchors/sbom-action dependency from v0.24.0 to v0.24.2. The updated commit SHA (3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) was verified to match the target version, ensuring security via pinning. Both occurrences of the action in the workflow were updated consistently to maintain behavioral parity between the SPDX and CycloneDX generation steps.

Reviewed changed lines

• .github/workflows/sbom-generation.yml:57 (RIGHT): Verified that the SHA '3ad7283483fc7af8ff2b4ea19663c2d5ca935e26' correctly maps to version v0.24.2 of anchore/sbom-action, maintaining the project's security requirement for SHA-pinned actions.
• .github/workflows/sbom-generation.yml:69 (RIGHT): Confirmed consistent update of both action calls within the workflow to prevent version mismatch and maintain behavioral parity between SPDX and CycloneDX generation steps.

Adversarial validation

• .github/workflows/sbom-generation.yml:57 (RIGHT) falsified: The updated SHA does not correspond to v0.24.2, potentially introducing untrusted code. — SHA matches release tag.
• .github/workflows/sbom-generation.yml:69 (RIGHT) falsified: Partial update of action versions leads to inconsistent SBOM generation behavior or version mismatch within the same job. — Both lines were updated to 3ad7283483fc7af8ff2b4ea19663c2d5ca935e26.
• Residual risk: Low. This is a patch version update to a standard tooling action with no changes to input parameters.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: fd964d243c27e46b02e214f973401357002a78ba
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]