DaanHoogland opened a new pull request, #14570:
URL: https://github.com/apache/cloudstack/pull/14570
### Description
Follow-up to #12570.
- **Replace `sbomify/sbomify-action@master`.** The action is not on the ASF
GitHub Actions allow-list (apache/infrastructure-actions), so the UI and marvin
SBOM jobs would not be allowed to run. The SBOMs are now generated with the
CycloneDX command-line tools, pinned to a version, in `run:` steps:
- UI: `@cyclonedx/cyclonedx-npm` 6.0.1 from `ui/package-lock.json`,
without dev dependencies (build tooling that is not shipped in the UI bundle).
`actions/setup-node` is added because the tool needs Node 20.18 or later.
- marvin: `cyclonedx-bom` 7.5.0 (`cyclonedx-py environment`) on the venv
marvin's dependencies are installed into. This adds license data that the `pip
freeze` list didn't have. The generator runs from its own venv so it doesn't
show up in marvin's SBOM.
- **Put the CycloneDX Maven plugin in an `sbom` profile.** Until now it was
bound to `package` for every build. It now only runs with `-Psbom` (or
`-Dsbom`) and is bound to `validate`. `makeAggregateBom` resolves the whole
reactor from the root before any module is built, so the java-sbom job no
longer needs a build: `mvn -Dnoredist -Psbom validate` writes
`target/ACS.sbom.{json,xml}` in about a minute.
The tag filter `[0-9]+.[0-9]+.[0-9]+*` is unchanged. In GitHub's filter
syntax `+` means one or more of the preceding character, so it matches release
tags like `4.22.0.0`.
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [x] Build/CI
- [ ] Test (unit or integration test code)
### How Has This Been Tested?
- `mvn -B -ntp -Dnoredist -Psbom validate` locally: build success, 583
components (154 CloudStack modules, including the noredist ones), 569 with
license data. Without `-Psbom` the plugin is no longer part of the build.
- A two-module test reactor confirmed that the aggregate BOM, bound at the
root, includes sibling modules that have not been built or installed, with the
correct dependency graph.
- The UI and marvin steps were not run locally. Their options were checked
against the documentation of the pinned versions. To be confirmed with a manual
run of the `generate sboms` workflow on this branch.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
