Skip to content

sbom: allow-listed generators and an sbom Maven profile #14570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DaanHoogland wants to merge 2 commits into
base: main
Choose a base branch
from
+59 −45
Open

sbom: allow-listed generators and an sbom Maven profile #14570

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1ae008e
sbom: replace non-allow-listed sbomify action, move CycloneDX plugin …
DaanHoogland Nov 3, 2026
0002282
ci: install sbom generator without install script execution
DaanHoogland Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,18 @@ jobs:
with:
persist-credentials: false

- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24

- name: Generate UI SBOM
uses: sbomify/sbomify-action@master
env:
LOCK_FILE: ui/package-lock.json
OUTPUT_FILE: sbom.ui.cdx.json
COMPONENT_NAME: cloudstack-ui
COMPONENT_VERSION: ${{ github.ref_name }}
UPLOAD: false
ENRICH: true
# the generator is installed outside the checkout without lifecycle scripts;
# dev dependencies are build tooling and are not shipped in the UI bundle
run: |
npm install --no-save --no-audit --no-fund --ignore-scripts \
--prefix "$RUNNER_TEMP/cdx" @cyclonedx/cyclonedx-npm@6.0.1
"$RUNNER_TEMP/cdx/node_modules/.bin/cyclonedx-npm" --package-lock-only --omit dev \
--spec-version 1.6 --output-format JSON --output-file sbom.ui.cdx.json ui/package.json

- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
Expand All @@ -62,7 +65,7 @@ jobs:
uses: ./.github/actions/setup-env

- name: Generate Java SBOM
run: mvn -B -ntp -Dnoredist org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
run: mvn -B -ntp -Dnoredist -Psbom validate

- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
Expand Down Expand Up @@ -100,17 +103,14 @@ jobs:
" > marvin-install-requires.txt
python3 -m venv marvin-venv
marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt
marvin-venv/bin/pip freeze > marvin-requirements.txt

- name: Generate marvin SBOM
uses: sbomify/sbomify-action@master
env:
LOCK_FILE: marvin-requirements.txt
OUTPUT_FILE: sbom.marvin.cdx.json
COMPONENT_NAME: cloudstack-marvin
COMPONENT_VERSION: ${{ github.ref_name }}
UPLOAD: false
ENRICH: true
# the generator gets its own venv so it doesn't end up in marvin's SBOM
run: |
python3 -m venv sbom-venv
sbom-venv/bin/pip install --quiet cyclonedx-bom==7.5.0
sbom-venv/bin/cyclonedx-py environment --spec-version 1.6 --output-format JSON \
--output-file sbom.marvin.cdx.json marvin-venv/bin/python

- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
Expand Down
68 changes: 41 additions & 27 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -877,33 +877,6 @@
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.9.1</version>
<executions>
<execution>
<phase>package</phase>
<inherited>false</inherited>
<goals>
<goal>makeAggregateBom</goal>
</goals>
</execution>
</executions>
<configuration>
<projectType>application</projectType>
<schemaVersion>1.6</schemaVersion>
<includeBomSerialNumber>true</includeBomSerialNumber>
<includeCompileScope>true</includeCompileScope>
<includeProvidedScope>true</includeProvidedScope>
<includeRuntimeScope>true</includeRuntimeScope>
<includeSystemScope>true</includeSystemScope>
<includeTestScope>false</includeTestScope>
<includeLicenseText>false</includeLicenseText>
<outputFormat>all</outputFormat>
<outputName>ACS.sbom</outputName>
</configuration>
</plugin>
</plugins>
<pluginManagement>
<plugins>
Expand Down Expand Up @@ -1316,6 +1289,47 @@
<module>systemvm</module>
</modules>
</profile>
<profile>
<!-- Writes target/ACS.sbom.{json,xml}: mvn -Psbom validate (add -Dnoredist to include those modules).
makeAggregateBom resolves the whole reactor from the root, so no modules need to be built first. -->
<id>sbom</id>
<activation>
<property>
<name>sbom</name>
</property>
</activation>
<build>
<plugins>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.9.1</version>
<executions>
<execution>
<phase>validate</phase>
<inherited>false</inherited>
<goals>
<goal>makeAggregateBom</goal>
</goals>
</execution>
</executions>
<configuration>
<projectType>application</projectType>
<schemaVersion>1.6</schemaVersion>
<includeBomSerialNumber>true</includeBomSerialNumber>
<includeCompileScope>true</includeCompileScope>
<includeProvidedScope>true</includeProvidedScope>
<includeRuntimeScope>true</includeRuntimeScope>
<includeSystemScope>true</includeSystemScope>
<includeTestScope>false</includeTestScope>
<includeLicenseText>false</includeLicenseText>
<outputFormat>all</outputFormat>
<outputName>ACS.sbom</outputName>
</configuration>
</plugin>
</plugins>
</build>
</profile>
<profile>
<id>eclipse</id>
<properties>
Expand Down
Loading