Skip to content

Commit 4d2e712

Browse files
DaanHooglandDaanHoogland
authored
sbom (#12570)
Co-authored-by: Daan Hoogland <dahn@apache.org>
1 parent d6390bd commit 4d2e712

2 files changed

Lines changed: 145 additions & 0 deletions

File tree

‎.github/workflows/sbom.yml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one
2+
# or more contributor license agreements. See the NOTICE file
3+
# distributed with this work for additional information
4+
# regarding copyright ownership. The ASF licenses this file
5+
# to you under the Apache License, Version 2.0 (the
6+
# "License"); you may not use this file except in compliance
7+
# with the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
18+
name: generate sboms
19+
20+
on:
21+
push:
22+
tags:
23+
- '[0-9]+.[0-9]+.[0-9]+*'
24+
workflow_dispatch:
25+
26+
permissions:
27+
contents: read
28+
29+
jobs:
30+
ui-sbom:
31+
name: ui sbom
32+
runs-on: ubuntu-24.04
33+
steps:
34+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
35+
with:
36+
persist-credentials: false
37+
38+
- name: Generate UI SBOM
39+
uses: sbomify/sbomify-action@master
40+
env:
41+
LOCK_FILE: ui/package-lock.json
42+
OUTPUT_FILE: sbom.ui.cdx.json
43+
COMPONENT_NAME: cloudstack-ui
44+
COMPONENT_VERSION: ${{ github.ref_name }}
45+
UPLOAD: false
46+
ENRICH: true
47+
48+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
49+
with:
50+
name: sbom-ui
51+
path: sbom.ui.cdx.json
52+
53+
java-sbom:
54+
name: java sbom
55+
runs-on: ubuntu-24.04
56+
steps:
57+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
58+
with:
59+
persist-credentials: false
60+
61+
- name: Setup Environment
62+
uses: ./.github/actions/setup-env
63+
64+
- name: Generate Java SBOM
65+
run: mvn -B -ntp -Dnoredist org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
66+
67+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
68+
with:
69+
name: sbom-java
70+
path: target/ACS.sbom.*
71+
72+
marvin-sbom:
73+
name: marvin sbom
74+
runs-on: ubuntu-24.04
75+
steps:
76+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
77+
with:
78+
persist-credentials: false
79+
80+
- name: Setup Environment
81+
uses: ./.github/actions/setup-env
82+
with:
83+
install-python: 'true'
84+
85+
- name: Resolve marvin dependencies
86+
run: |
87+
# marvin's `packages` list includes the generated marvin.cloudstackAPI
88+
# module, which is created at build time from the API spec and isn't
89+
# checked in, so setup.py can't be built directly. Read the declared
90+
# install_requires instead of building the package.
91+
python3 -c "
92+
import ast
93+
tree = ast.parse(open('tools/marvin/setup.py').read())
94+
for node in ast.walk(tree):
95+
if isinstance(node, ast.Call) and getattr(node.func, 'id', None) == 'setup':
96+
for kw in node.keywords:
97+
if kw.arg == 'install_requires':
98+
for elt in kw.value.elts:
99+
print(elt.value)
100+
" > marvin-install-requires.txt
101+
python3 -m venv marvin-venv
102+
marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt
103+
marvin-venv/bin/pip freeze > marvin-requirements.txt
104+
105+
- name: Generate marvin SBOM
106+
uses: sbomify/sbomify-action@master
107+
env:
108+
LOCK_FILE: marvin-requirements.txt
109+
OUTPUT_FILE: sbom.marvin.cdx.json
110+
COMPONENT_NAME: cloudstack-marvin
111+
COMPONENT_VERSION: ${{ github.ref_name }}
112+
UPLOAD: false
113+
ENRICH: true
114+
115+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
116+
with:
117+
name: sbom-marvin
118+
path: sbom.marvin.cdx.json

‎pom.xml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -877,6 +877,33 @@
877877
</execution>
878878
</executions>
879879
</plugin>
880+
<plugin>
881+
<groupId>org.cyclonedx</groupId>
882+
<artifactId>cyclonedx-maven-plugin</artifactId>
883+
<version>2.9.1</version>
884+
<executions>
885+
<execution>
886+
<phase>package</phase>
887+
<inherited>false</inherited>
888+
<goals>
889+
<goal>makeAggregateBom</goal>
890+
</goals>
891+
</execution>
892+
</executions>
893+
<configuration>
894+
<projectType>application</projectType>
895+
<schemaVersion>1.6</schemaVersion>
896+
<includeBomSerialNumber>true</includeBomSerialNumber>
897+
<includeCompileScope>true</includeCompileScope>
898+
<includeProvidedScope>true</includeProvidedScope>
899+
<includeRuntimeScope>true</includeRuntimeScope>
900+
<includeSystemScope>true</includeSystemScope>
901+
<includeTestScope>false</includeTestScope>
902+
<includeLicenseText>false</includeLicenseText>
903+
<outputFormat>all</outputFormat>
904+
<outputName>ACS.sbom</outputName>
905+
</configuration>
906+
</plugin>
880907
</plugins>
881908
<pluginManagement>
882909
<plugins>

0 commit comments

Comments
 (0)