docs(legal): add Project Support / AS-IS disclaimer to README

.github/workflows/dependency-audit.yml

@@ -24,15 +24,15 @@ jobs:
     runs-on: databrickslabs-protected-runner-group
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
 
       - name: Install audit tools
         run: pip install pip-audit==2.9.0

.github/workflows/release.yml

@@ -14,10 +14,13 @@ jobs:
     runs-on: databrickslabs-protected-runner-group
     permissions:
       contents: write
+      # id-token: write is required for cosign keyless signing via GitHub OIDC.
+      # Without it, cosign falls back to interactive auth and the workflow hangs.
+      id-token: write
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
 
@@ -111,10 +114,52 @@ jobs:
           git tag -a "$TAG" -m "Release $TAG"
           git push origin "$TAG"
 
+      # ----- Supply-chain provenance: SBOM + cosign keyless signature ---------
+      # Generates a CycloneDX SBOM from the repo (Python + npm package metadata),
+      # then signs it with cosign using a short-lived OIDC token from GitHub.
+      # Verifiers can confirm the SBOM came from this workflow at this tag via:
+      #   cosign verify-blob --bundle coda-sbom.cdx.json.cosign.bundle \
+      #     --certificate-identity-regexp 'https://github.com/databrickslabs/coding-agents-databricks-apps/.+' \
+      #     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+      #     coda-sbom.cdx.json
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@9f7302141466aa6482940f15371237e9d9f4c34a  # v0.20.5
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: coda-sbom.cdx.json
+          # Don't auto-upload; we attach via softprops below for one consistent release.
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@d7d6e07ee54d2049ce5cdfc7eed4d6a6ccd80f5b  # v3.5.0
+        with:
+          cosign-release: v2.4.1
+
+      - name: Sign SBOM with cosign (keyless OIDC)
+        run: |
+          # --yes auto-confirms the Sigstore transparency log entry (Rekor).
+          # The resulting bundle contains the signature + certificate + Rekor
+          # inclusion proof in one self-contained file — easier for downstream
+          # verifiers than separate .sig/.cert files.
+          cosign sign-blob --yes \
+            --bundle coda-sbom.cdx.json.cosign.bundle \
+            coda-sbom.cdx.json
+          # Sanity check: verify what we just signed before publishing.
+          cosign verify-blob \
+            --bundle coda-sbom.cdx.json.cosign.bundle \
+            --certificate-identity-regexp 'https://github.com/${{ github.repository }}/.+' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            coda-sbom.cdx.json
+
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3
         with:
           tag_name: "${{ steps.version.outputs.TAG }}"
           name: "${{ steps.version.outputs.TAG }}"
           body: ${{ steps.notes.outputs.NOTES }}
           prerelease: ${{ inputs.prerelease }}
+          files: |
+            coda-sbom.cdx.json
+            coda-sbom.cdx.json.cosign.bundle

.github/workflows/test.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: databrickslabs-protected-runner-group
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
 
       - name: Run tests
         run: uv run pytest tests/ -v

.github/workflows/update-lockfile.yml

@@ -14,15 +14,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
 
       - name: Regenerate requirements.lock
         run: uv pip compile requirements.txt -o requirements.lock --generate-hashes

README.md

@@ -10,6 +10,22 @@
 
 ---
 
+## 💬 Project Support
+
+Please note that this project is provided for your exploration only and is not
+formally supported by Databricks with Service Level Agreements (SLAs). It is
+provided AS-IS, and we do not make any guarantees. Please do not submit a
+support ticket relating to any issues arising from the use of this project.
+
+Any issues discovered through the use of this project should be filed as GitHub
+[Issues on this repository](https://github.com/databrickslabs/coding-agents-databricks-apps/issues).
+
+See [LICENSE.md](LICENSE.md) for full terms, including the warranty disclaimer
+and limitation of liability. See [NOTICE.md](NOTICE.md) for third-party software
+attribution.
+
+---
+
 <div align="center">
   <video src="https://github.com/user-attachments/assets/40405b46-532a-4f14-82e3-414cb3744684" controls width="900"></video>
 </div>
@@ -330,6 +346,8 @@ Open [http://localhost:8000](http://localhost:8000) — type `claude`, `codex`,
 
 Single-user app — the owner is resolved via the app's service principal and Apps API (`app.creator`), with no PAT required at deploy time. Authorization checks `X-Forwarded-Email` against `app.creator`. On first terminal session, the user pastes a short-lived PAT interactively. Tokens auto-rotate every 10 minutes (15-minute lifetime), with old tokens proactively revoked. On restart, the user re-pastes (no persistence by design).
 
+Each GitHub Release ships a signed CycloneDX SBOM — see [docs/SECURITY.md](./docs/SECURITY.md) for verification steps.
+
 ### Gunicorn
 
 Production uses `workers=1` (PTY state is process-local), `threads=16` (concurrent polling + WebSocket), `gthread` worker class, `timeout=60` (long-lived WebSocket connections).

docs/SECURITY.md

@@ -0,0 +1,23 @@
+# Security
+
+## Verifying release provenance
+
+Each GitHub Release ships with:
+
+- `coda-sbom.cdx.json` — CycloneDX SBOM of every Python + npm dependency (generated by [syft](https://github.com/anchore/syft)).
+- `coda-sbom.cdx.json.cosign.bundle` — [Sigstore](https://www.sigstore.dev/) keyless signature bundle (cert + signature + Rekor inclusion proof in one file).
+
+To verify a release came from this repo's release workflow:
+
+```bash
+TAG=v1.0.0   # the release you downloaded
+gh release download "$TAG" -p 'coda-sbom.cdx.json*'
+
+cosign verify-blob \
+  --bundle coda-sbom.cdx.json.cosign.bundle \
+  --certificate-identity-regexp 'https://github.com/databrickslabs/coding-agents-databricks-apps/.+' \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+  coda-sbom.cdx.json
+```
+
+Signing uses GitHub's OIDC token — no long-lived signing keys exist. The signing identity is anchored to the workflow path + tag ref, and a public transparency-log entry is recorded in Rekor.