cloudstack/.github/workflows/sbom.yml at main · apache/cloudstack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: generate sboms

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ui-sbom:
    name: ui sbom
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24

      - name: Generate UI SBOM
        # the generator is installed outside the checkout without lifecycle scripts;
        # dev dependencies are build tooling and are not shipped in the UI bundle
        run: |
          npm install --no-save --no-audit --no-fund --ignore-scripts \
            --prefix "$RUNNER_TEMP/cdx" @cyclonedx/cyclonedx-npm@6.0.1
          "$RUNNER_TEMP/cdx/node_modules/.bin/cyclonedx-npm" --package-lock-only --omit dev \
            --spec-version 1.6 --output-format JSON --output-file sbom.ui.cdx.json ui/package.json

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom-ui
          path: sbom.ui.cdx.json

  java-sbom:
    name: java sbom
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Environment
        uses: ./.github/actions/setup-env

      - name: Generate Java SBOM
        run: mvn -B -ntp -Dnoredist -Psbom org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom-java
          path: target/ACS.sbom.*

  marvin-sbom:
    name: marvin sbom
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Environment
        uses: ./.github/actions/setup-env
        with:
          install-python: 'true'

      - name: Resolve marvin dependencies
        run: |
          # marvin's `packages` list includes the generated marvin.cloudstackAPI
          # module, which is created at build time from the API spec and isn't
          # checked in, so setup.py can't be built directly. Read the declared
          # install_requires instead of building the package.
          python3 -c "
          import ast
          tree = ast.parse(open('tools/marvin/setup.py').read())
          for node in ast.walk(tree):
              if isinstance(node, ast.Call) and getattr(node.func, 'id', None) == 'setup':
                  for kw in node.keywords:
                      if kw.arg == 'install_requires':
                          for elt in kw.value.elts:
                              print(elt.value)
          " > marvin-install-requires.txt
          python3 -m venv marvin-venv
          marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt

      - name: Generate marvin SBOM
        # the generator gets its own venv so it doesn't end up in marvin's SBOM
        run: |
          python3 -m venv sbom-venv
          sbom-venv/bin/pip install --quiet cyclonedx-bom==7.5.0
          sbom-venv/bin/cyclonedx-py environment --spec-version 1.6 --output-format JSON \
            --output-file sbom.marvin.cdx.json marvin-venv/bin/python

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom-marvin
          path: sbom.marvin.cdx.json