feat(container-images): collect hidden bytes from containerd snapshots

[Stephanie0829]

What does this PR do?

Add default-on container-image measurements for Linux/containerd:

• Per-layer hidden_bytes: file data stored in older layers but hidden by later deletion or replacement.
• Image-level uncompressed_size: regular-file data across all layers, including hidden versions and counting same-layer hardlinks once. Excludes tar overhead, symlinks, directories, whiteout markers, and image metadata.

No percentage is sent. The existing image size field is unchanged.

Enabled automatically with container-image collection. Set container_image.hidden_bytes.enabled: false (or DD_CONTAINER_IMAGE_HIDDEN_BYTES_ENABLED=false) to opt out of both measurements.

Collection checks the immutable-image cache, then prefers unpacked overlayfs snapshots through SBOM's access helpers. If those cannot be scanned, it streams layer archives already in containerd's local ContentStore: no registry downloads or extraction. Complete measurements are cached and published together; unavailable results are omitted, not zero. Older caches without the total require a fresh scan.

Supported hardlinks count once; their bytes become hidden only when their last visible name disappears. Snapshot scans read metadata; archive scans read and decompress contents but discard them. Scan time, entries, paths, metadata, and archive bytes are bounded.

Motivation

Identify image layers containing hidden file data and provide a comparable uncompressed total for later analysis. These are logical file bytes, not compressed download savings or guaranteed reclaimable disk space. No efficiency score, backend aggregation, or UI changes.

Describe how you validated your changes

Ran the rebuilt Agent in ARM64 minikube with containerd and fakeintake. Assertions checked received config IDs, ordered DiffIDs, every hidden-byte value, and the exact image total against an independent Docker-export/tar-header oracle.

• All 13 fixtures passed with fresh caches through snapshots/archive fallback and again through archives alone, including deletions, replacements, hardlinks, and a native-only snapshotter image.
• Verified default-on collection without an explicit enable setting, warm-cache restart, and omission of both fields when disabled with a populated cache.
• An existing etcd image with a missing layer blob reported through snapshots and omitted both measurements when snapshots were also inaccessible. No runtime blobs were deleted.
• Earlier validation also covered concurrent SBOM payloads and snapshot/lease cleanup.

Reproducible QA instructions · Recorded results and reviewer rerun commands.

Additional Notes

• Depends on agent-payload #525, pinned to published commit 451811d2b5dc across existing module references.
• Not universal containerd coverage: inaccessible snapshots plus missing local archives, unsupported hardlinks/metadata, or scan limits leave measurements unavailable.
• Reuses SBOM snapshot access without requiring SBOM or expanding SBOM's snapshotter support.
• Cold archive scans took about four minutes for the retained inventory; an initial assertion timed out while fixtures were queued, then passed after scanning completed.
• Cluster stop/start and same-tag replacement remain reviewer QA. The minikube profile is retained for user validation; both PRs remain drafts.

🤖 Generated with Claude Code

[github-actions]

AI review by Codex (OpenAI) - workflow run

patch is correct within the requested SKILL.md review scope. One skill changed: the update removes --no-edit and explains the compatibility reason. Overall score: 83/100 (Approve). The suggestions below concern the whole-file rubric; they are not regressions introduced by this patch.

[github-actions]

[P3] Skill assessment — 83/100, Approve

Scores: Description 17/25; Writing philosophy 22/25; Structure and progressive disclosure 24/25; Output definition and examples 20/25.

The 137-line skill has a clear purpose, imperative steps, short commands, a YAML output template, and explicit lint-based success criteria. The changed instructions explain why the unsupported flag should be omitted. It does not operate on production. Ownership exists in CODEOWNERS (@DataDog/agent-devx), but is not declared in the skill. create-pr mentions release notes without duplicating this workflow.

Top 3 improvements:

1. Expand the description (line 3) with explicit triggering language and user phrases to improve discovery.
2. Add a complete input/output example alongside the usage section: a request to fix an NTP timeout → generated filename, concrete fixes YAML, and validation result. Existing examples show fragments rather than the full outcome.
3. Declare @DataDog/agent-devx as owner and list prerequisites together, including reno and the dda environment required for validation.

Suggested description: “Create and validate a reno release note for Datadog Agent or Cluster Agent changes. Use when users ask to ‘add a release note’, ‘write a changelog entry’, or ‘create a reno note’, or when a PR needs a customer-facing release note. Skip changes eligible for changelog/no-changelog.”

Overall recommendation: Approve. Priority: 3.

[dd-octo-sts]

Benchmarks

Benchmark execution time: 2026-09-24 17:49:57

Comparing candidate commit b2caeb8 in PR branch codex/container-image-hidden-bytes with baseline commit f1ba530 in branch main.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 3 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 73.14%
• Overall Coverage: 56.78% (+0.02%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b2caeb8 | Docs | Give us feedback!}

[dd-octo-sts]

Files inventory check summary

File checks results against ancestor 5061317e:

Results for datadog-agent_7.85.0~devel.git.543.b2caeb8.pipeline.139917600-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.85.0~devel.git.543.b2caeb8.pipeline.139917600-1_amd64.deb:

No change detected

[dd-octo-sts]

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 5061317
📊 Static Quality Gates Dashboard
🔗 SQG Job

Successful checks

Info

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	+137.8 KiB (0.02% increase, -8.25% of buffer)	784.349 → 784.483 → 785.980
✅	agent_deb_amd64_fips	+149.64 KiB (0.02% increase, -6.75% of buffer)	717.043 → 717.190 → 719.210
✅	agent_heroku_amd64	+8.19 KiB (0.00% increase, -0.14% of buffer)	317.455 → 317.463 → 323.180
✅	agent_msi	+39.5 KiB (0.01% increase, -0.26% of buffer)	653.790 → 653.828 → 668.830
✅	agent_rpm_amd64	+137.8 KiB (0.02% increase, -8.32% of buffer)	784.333 → 784.467 → 785.950
✅	agent_rpm_amd64_fips	+149.64 KiB (0.02% increase, -6.69% of buffer)	717.027 → 717.173 → 719.210
✅	agent_rpm_arm64	+124.48 KiB (0.02% increase, -4.08% of buffer)	754.944 → 755.065 → 757.920
✅	agent_rpm_arm64_fips	+120.67 KiB (0.02% increase, -3.17% of buffer)	693.266 → 693.383 → 696.980
✅	agent_suse_amd64	+137.8 KiB (0.02% increase, -8.32% of buffer)	784.333 → 784.467 → 785.950
✅	agent_suse_amd64_fips	+149.64 KiB (0.02% increase, -6.69% of buffer)	717.027 → 717.173 → 719.210
✅	agent_suse_arm64	+124.48 KiB (0.02% increase, -4.08% of buffer)	754.944 → 755.065 → 757.920
✅	agent_suse_arm64_fips	+120.67 KiB (0.02% increase, -3.17% of buffer)	693.266 → 693.383 → 696.980
✅	docker_agent_amd64	+141.66 KiB (0.02% increase, -75.66% of buffer)	843.377 → 843.515 → 843.560
✅	docker_agent_arm64	+128.33 KiB (0.01% increase, -4.36% of buffer)	839.005 → 839.130 → 841.880
✅	docker_agent_jmx_amd64	+141.65 KiB (0.01% increase, -77.33% of buffer)	1034.291 → 1034.429 → 1034.470
✅	docker_agent_jmx_arm64	+128.32 KiB (0.01% increase, -4.36% of buffer)	1018.699 → 1018.824 → 1021.570
✅	docker_dogstatsd_amd64	+216.91 KiB (0.54% increase, -20.32% of buffer)	39.398 → 39.610 → 40.440
✅	docker_dogstatsd_arm64	+192.92 KiB (0.50% increase, -17.49% of buffer)	37.503 → 37.691 → 38.580
✅	docker_host_profiler_amd64	+7.29 KiB (0.00% increase, -0.06% of buffer)	307.877 → 307.885 → 319.490
✅	docker_host_profiler_arm64	+7.34 KiB (0.00% increase, -0.06% of buffer)	319.077 → 319.084 → 330.690
✅	dogstatsd_deb_amd64	+212.91 KiB (0.69% increase, -19.26% of buffer)	30.140 → 30.348 → 31.220
✅	dogstatsd_deb_arm64	+188.91 KiB (0.66% increase, -12.83% of buffer)	28.152 → 28.337 → 29.590
✅	dogstatsd_rpm_amd64	+212.91 KiB (0.69% increase, -19.26% of buffer)	30.140 → 30.348 → 31.220
✅	dogstatsd_suse_amd64	+212.91 KiB (0.69% increase, -19.26% of buffer)	30.140 → 30.348 → 31.220
✅	iot_agent_deb_amd64	+8.16 KiB (0.02% increase, -0.77% of buffer)	46.518 → 46.526 → 47.550
✅	iot_agent_deb_arm64	+8.12 KiB (0.02% increase, -0.74% of buffer)	43.143 → 43.151 → 44.220
✅	iot_agent_deb_armhf	+4.16 KiB (0.01% increase, -0.39% of buffer)	43.968 → 43.972 → 45.020
✅	iot_agent_rpm_amd64	+8.16 KiB (0.02% increase, -0.77% of buffer)	46.518 → 46.526 → 47.550
✅	iot_agent_suse_amd64	+8.16 KiB (0.02% increase, -0.77% of buffer)	46.517 → 46.525 → 47.550
✅	docker_cluster_agent_amd64	+4.41 KiB (0.00% increase, -1.92% of buffer)	213.476 → 213.480 → 213.700
✅	docker_cluster_agent_arm64	+64.39 KiB (0.03% increase, -25.12% of buffer)	226.410 → 226.473 → 226.660

2 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	docker_cws_instrumentation_amd64	7.439 MiB
✅	docker_cws_instrumentation_arm64	6.877 MiB

[cit-pr-commenter-54b7da]

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Job ID: 9fb436f3-4f9b-41ff-9d1c-68e9bbd30773

Baseline: 5061317
Comparison: b2caeb8
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	dsd_uds_10mb_3k_timestamped_contexts_cpu	% cpu utilization	+1.15	[+0.90, +1.39]	1	Logs
➖	quality_gate_security_no_fs_load	memory utilization	+0.33	[+0.26, +0.41]	1	Logs bounds checks dashboard
➖	quality_gate_idle	memory utilization	+0.25	[+0.21, +0.29]	1	Logs bounds checks dashboard
➖	quality_gate_metrics_logs	memory utilization	+0.15	[-0.07, +0.38]	1	Logs bounds checks dashboard
➖	quality_gate_private_action_runner	memory utilization	+0.12	[-0.02, +0.25]	1	Logs bounds checks dashboard
➖	quality_gate_security_idle	memory utilization	+0.03	[-0.00, +0.06]	1	Logs bounds checks dashboard
➖	quality_gate_security_mean_fs_load	memory utilization	-0.32	[-0.35, -0.28]	1	Logs bounds checks dashboard
➖	quality_gate_idle_all_features	memory utilization	-0.43	[-0.46, -0.39]	1	Logs bounds checks dashboard
➖	quality_gate_logs	% cpu utilization	-0.48	[-1.35, +0.39]	1	Logs bounds checks dashboard
➖	dsd_uds_10mb_3k_timestamped_contexts_memory	memory utilization	-0.89	[-1.10, -0.68]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	observed_value	links
✅	quality_gate_idle	intake_connections	10/10	4 ≤ 5	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	176.42MiB ≤ 179MiB	bounds checks dashboard
✅	quality_gate_idle	total_bytes_received	10/10	748.91KiB ≤ 819.20KiB	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	4 ≤ 5	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	525.77MiB ≤ 537MiB	bounds checks dashboard
✅	quality_gate_idle_all_features	total_bytes_received	10/10	1.14MiB ≤ 1.25MiB	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	20 ≤ 40	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	214.16MiB ≤ 228MiB	bounds checks dashboard
✅	quality_gate_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_logs	total_bytes_received	10/10	263.54MiB ≤ 292MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	384.78 ≤ 2000	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	19 ≤ 40	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	425.67MiB ≤ 455MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_metrics_logs	total_bytes_received	10/10	0.94GiB ≤ 1.04GiB	bounds checks dashboard
✅	quality_gate_private_action_runner	memory_usage	10/10	72.93MiB ≤ 75MiB	bounds checks dashboard
✅	quality_gate_security_idle	cpu_usage	10/10	30.82 ≤ 100	bounds checks dashboard
✅	quality_gate_security_idle	memory_usage	10/10	324.88MiB ≤ 355MiB	bounds checks dashboard
✅	quality_gate_security_mean_fs_load	cpu_usage	10/10	65.39 ≤ 200	bounds checks dashboard
✅	quality_gate_security_mean_fs_load	memory_usage	10/10	303.55MiB ≤ 335MiB	bounds checks dashboard
✅	quality_gate_security_no_fs_load	cpu_usage	10/10	24.39 ≤ 100	bounds checks dashboard
✅	quality_gate_security_no_fs_load	memory_usage	10/10	326.06MiB ≤ 345MiB	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

• quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
• quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
• quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
• quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
• quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
• quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
• quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
• quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
• quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
• quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
• quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
• quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
• quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.

[Stephanie0829]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T17:39:16.107983Z	b2caeb8	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3980f26f3e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip privileged checks for user-xattr layers

When containerd returns an overlay mount with userxattr, BuildImageLayers explicitly marks the layers to read user.overlay.*, but this unconditional check still rejects any process outside the initial user namespace or without CAP_SYS_ADMIN. Those privileges are required for trusted.overlay.*, not user xattrs, so rootless/user-xattr overlayfs images that otherwise pass mount validation can never produce hidden-byte results. Apply the privilege check only when at least one layer uses trusted xattrs.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add a fakeintake E2E assertion for hidden bytes

This changes the customer-visible container-image payload, but a repo-wide check found only unit tests and the manually driven test/integration/container_image_hidden_bytes setup—there is no test/new-e2e assertion for hidden_bytes. Consequently, a break anywhere in the real containerd → workloadmeta → container-image check → fakeintake path can pass CI; add and wire an E2E test that deploys the Agent and verifies nil, zero, and nonzero values in fakeintake.

AGENTS.md reference: AGENTS.md:L98-L106

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add trigger phrases and ownership to the release-note skill

Skill score: Description 15/25, Writing philosophy 20/25, Structure/progressive disclosure 24/25, Output/examples 19/25; total 78/100 — Approve with suggestions. Top improvements: (1) make the frontmatter description state when to invoke the skill using concrete prompts, (2) declare the owning team, and (3) add one complete user-input-to-generated-note example and explicit success criteria. Suggested description: “Create and validate a reno release note for an Agent or Cluster Agent change; use when a user asks to add, write, generate, or fix a changelog or release note.”

Useful? React with 👍 / 👎.

[Stephanie0829]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f13eb1896a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Stephanie0829]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0641fde6b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Evict stale IDs when mutable image tags move

When containerd emits an image-update event because a mutable tag is repointed to a new config digest, knownImages.addReference removes that name from the previous ID, but this map and the corresponding hidden-byte job are only cleared by an image-delete event. Containerd can update the image record without emitting that delete, so every old digest remains in latestImages and hiddenBytes.jobs; an unfinished job also retries against the now-moved tag before becoming permanently retained. Nodes that repeatedly refresh tags such as latest therefore accumulate full image metadata (including compressed SBOMs) and jobs for the lifetime of the Agent. Remove the previous ID's hidden-byte state when the update leaves it without references.

Useful? React with 👍 / 👎.

[Stephanie0829]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a2f0e1d39

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid retriggering pending SBOM scans

When SBOM collection is enabled and hidden-byte collection finishes while the image's SBOM is still Pending, this publishes another SET event containing that pending state. handleEventBundle treats every such event as an unattempted SBOM and calls Scanner.Scan; if the original request is already being processed, the workqueue marks it dirty and processes it again after Done, potentially doubling expensive Trivy scans and startup CPU/disk work. Suppress the SBOM trigger for hidden-only publications or track scans already in flight.

Useful? React with 👍 / 👎.

[Stephanie0829]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: b2caeb8de5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".