From 5b561e4e26d22e8da73496dfd4c0ac1239b55db7 Mon Sep 17 00:00:00 2001 From: Haksung Jang Date: Thu, 3 Sep 2026 11:28:52 +0900 Subject: [PATCH] Wire cdxgen/govulncheck/scancode/toolchain-cache env vars into compose 10 vars documented in .env.example (cdxgen image/spec selection, govulncheck subprocess limits, scancode enable flag, shared per-language toolchain cache size/idle/roots) were never referenced in x-backend-env, so setting them in .env had no effect on the running container. Adds them with defaults matching core/config.py exactly. EXTRACTCODE_LIBARCHIVE_PATH / TYPECODE_LIBMAGIC_PATH were also flagged by the audit but are deliberately excluded: Dockerfile.worker bakes them as image ENV pointing scancode's ctypes loader at the arm64 system libarchive/libmagic, and an ${VAR:-} compose line would shadow that with an empty string and crash scancode on import. Part of the compose env-var wiring audit. --- docker-compose.dev.yml | 25 +++++++++++++++++++++++++ docker-compose.yml | 25 +++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 3bf8d315..06b10add 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -264,6 +264,31 @@ x-backend-env: &backend-env SOURCE_ARCHIVE_RETENTION_HOURS: ${SOURCE_ARCHIVE_RETENTION_HOURS:-24} VEX_IMPORT_MAX_BYTES: ${VEX_IMPORT_MAX_BYTES:-8388608} VEX_IMPORT_MAX_STATEMENTS: ${VEX_IMPORT_MAX_STATEMENTS:-100000} + # compose-env-var wiring audit: cdxgen image/spec selection, govulncheck + # subprocess limits, scancode enable flag, and the shared per-language + # toolchain cache (size/idle/roots). Documented in .env.example but never + # listed in this anchor, so setting any of them in .env had no effect on + # the running container. Defaults match core/config.py exactly, so an + # unset .env changes nothing for an existing deployment. + # + # NOT included here: EXTRACTCODE_LIBARCHIVE_PATH / TYPECODE_LIBMAGIC_PATH. + # Both are also documented in .env.example and also missing from this + # anchor, but Dockerfile.worker bakes them as image ENV (pointing + # scancode's ctypes loader at the arm64 system libarchive/libmagic, see + # integrations/_subprocess_env.py). Adding an `${VAR:-}` line here would + # shadow that image default with an empty string and crash scancode on + # import, which is worse than the gap it would "fix". They stay + # unreferenced deliberately. + CDXGEN_ALLINONE_IMAGE: ${CDXGEN_ALLINONE_IMAGE:-ghcr.io/cyclonedx/cdxgen:v12.5.0} + CDXGEN_FETCH_LICENSE: ${CDXGEN_FETCH_LICENSE:-} + CDXGEN_IMAGE_TAG: ${CDXGEN_IMAGE_TAG:-v12} + CDXGEN_SPEC_VERSION: ${CDXGEN_SPEC_VERSION:-1.5} + GOVULNCHECK_MAX_OUTPUT_BYTES: ${GOVULNCHECK_MAX_OUTPUT_BYTES:-67108864} + GOVULNCHECK_TIMEOUT_SECONDS: ${GOVULNCHECK_TIMEOUT_SECONDS:-600} + SCANCODE_ENABLED: ${SCANCODE_ENABLED:-true} + TOOLCHAIN_CACHE_IDLE_SECONDS: ${TOOLCHAIN_CACHE_IDLE_SECONDS:-900} + TOOLCHAIN_CACHE_MAX_BYTES: ${TOOLCHAIN_CACHE_MAX_BYTES:-8589934592} + TOOLCHAIN_CACHE_ROOTS: ${TOOLCHAIN_CACHE_ROOTS:-} services: postgres: diff --git a/docker-compose.yml b/docker-compose.yml index 27398884..02dd1063 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -358,6 +358,31 @@ x-backend-env: &backend-env SOURCE_ARCHIVE_RETENTION_HOURS: ${SOURCE_ARCHIVE_RETENTION_HOURS:-24} VEX_IMPORT_MAX_BYTES: ${VEX_IMPORT_MAX_BYTES:-8388608} VEX_IMPORT_MAX_STATEMENTS: ${VEX_IMPORT_MAX_STATEMENTS:-100000} + # compose-env-var wiring audit: cdxgen image/spec selection, govulncheck + # subprocess limits, scancode enable flag, and the shared per-language + # toolchain cache (size/idle/roots). Documented in .env.example but never + # listed in this anchor, so setting any of them in .env had no effect on + # the running container. Defaults match core/config.py exactly, so an + # unset .env changes nothing for an existing deployment. + # + # NOT included here: EXTRACTCODE_LIBARCHIVE_PATH / TYPECODE_LIBMAGIC_PATH. + # Both are also documented in .env.example and also missing from this + # anchor, but Dockerfile.worker bakes them as image ENV (pointing + # scancode's ctypes loader at the arm64 system libarchive/libmagic, see + # integrations/_subprocess_env.py). Adding an `${VAR:-}` line here would + # shadow that image default with an empty string and crash scancode on + # import, which is worse than the gap it would "fix". They stay + # unreferenced deliberately. + CDXGEN_ALLINONE_IMAGE: ${CDXGEN_ALLINONE_IMAGE:-ghcr.io/cyclonedx/cdxgen:v12.5.0} + CDXGEN_FETCH_LICENSE: ${CDXGEN_FETCH_LICENSE:-} + CDXGEN_IMAGE_TAG: ${CDXGEN_IMAGE_TAG:-v12} + CDXGEN_SPEC_VERSION: ${CDXGEN_SPEC_VERSION:-1.5} + GOVULNCHECK_MAX_OUTPUT_BYTES: ${GOVULNCHECK_MAX_OUTPUT_BYTES:-67108864} + GOVULNCHECK_TIMEOUT_SECONDS: ${GOVULNCHECK_TIMEOUT_SECONDS:-600} + SCANCODE_ENABLED: ${SCANCODE_ENABLED:-true} + TOOLCHAIN_CACHE_IDLE_SECONDS: ${TOOLCHAIN_CACHE_IDLE_SECONDS:-900} + TOOLCHAIN_CACHE_MAX_BYTES: ${TOOLCHAIN_CACHE_MAX_BYTES:-8589934592} + TOOLCHAIN_CACHE_ROOTS: ${TOOLCHAIN_CACHE_ROOTS:-} services: # ---------------------------------------------------------------------------