Ignore audit_trail.txt, the other half of a generated pair - #393
Open
vpetersson-bot wants to merge 1 commit into
Open
vpetersson-bot wants to merge 1 commit into
vpetersson-bot wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
vpetersson-bot
force-pushed
the
chore/gitignore-audit-trail
branch
from
August 31, 2026 15:43
d361473 to
d0b108f
Compare
vpetersson-bot
force-pushed
the
chore/gitignore-audit-trail
branch
from
August 31, 2026 15:49
d0b108f to
d8764e5
Compare
A run writes sbom_output.json and audit_trail.txt side by side (console.py), but only the first was ignored. So running the tool inside a checkout leaves audit_trail.txt untracked and ready to be swept into a commit, which is how it reached sbomify#389. What it carries is the reason this matters rather than being untidy: the file records the absolute input path, so a committed one publishes the generating machine's directory layout and username. Separately worth deciding, and not addressed here: whether the audit trail should record an absolute path at all. It is a compliance artifact meant to be handed to someone else, and the full local path is of no use to them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vpetersson-bot
force-pushed
the
chore/gitignore-audit-trail
branch
from
August 31, 2026 18:32
d8764e5 to
7379646
Compare
vpetersson
pushed a commit
that referenced
this pull request
Sep 1, 2026
The audit trail is a compliance artifact: it exists to be handed to someone other than whoever generated it. The absolute path of the input lockfile tells that reader nothing they can use, while publishing the generating machine's directory layout and username: # Input: /private/tmp/claude-501/-Users-<username>-PycharmProjects-sbomify/.../requirements.txt Record a path under the working directory relative to it, and keep only the file name for anything outside. os.path.relpath is the wrong tool for the second case -- "../../../Users/<username>/..." leaks exactly what we are removing. Values that are not paths (docker:..., the additional-packages-only sentinel) are not absolute, so they pass through untouched. Both emitters are covered: the audit_trail.txt file and the copy printed to stdout for attestation. Follow-up to #393, which ignored the file but deliberately left the question of what it records open. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
aurangzaib048
added a commit
to aurangzaib048/sbomify-github-action
that referenced
this pull request
Sep 16, 2026
It is a generated runtime artifact that a run writes beside sbom_output.json, and the committed copy records the absolute input path from the machine that produced it, including a personal username. Nothing in the repo reads it. The ignore rule that stops it happening again is sbomify#393, so it is left out of this change rather than added in both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A run writes
sbom_output.jsonandaudit_trail.txtside by side (console.py), but only the first is in.gitignore. So running the tool inside a checkout leavesaudit_trail.txtuntracked and ready to be swept into a commit — which is how it reached #389.What the file carries is why this matters rather than being merely untidy. It records the absolute input path:
so a committed one publishes the generating machine's directory layout and username.
Separately worth deciding, and deliberately not addressed here: whether the audit trail should record an absolute path at all. It is a compliance artifact intended to be handed to someone else, and the generating machine's full local path is of no use to them — a relative path, or absolute only behind a flag, may be the better default. Happy to open that as an issue if you want it pursued.
Found via Copilot's review of #389.