This is an automated email from the ASF dual-hosted git repository. DaanHoogland pushed a commit to branch sbom-profile in repository https://gitbox.apache.org/repos/asf/cloudstack.git
commit 1ae008ecd51cd7b4d3047863d613640d2bbecd64 Author: Daan Hoogland <[email protected]> AuthorDate: Tue Nov 3 15:02:11 2026 +0100 sbom: replace non-allow-listed sbomify action, move CycloneDX plugin into an sbom profile --- .github/workflows/sbom.yml | 33 ++++++++++------------ pom.xml | 68 ++++++++++++++++++++++++++++------------------ 2 files changed, 56 insertions(+), 45 deletions(-) diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index d368c0e4e31..e2318154061 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -35,15 +35,15 @@ jobs: with: persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 24 + - name: Generate UI SBOM - uses: sbomify/sbomify-action@master - env: - LOCK_FILE: ui/package-lock.json - OUTPUT_FILE: sbom.ui.cdx.json - COMPONENT_NAME: cloudstack-ui - COMPONENT_VERSION: ${{ github.ref_name }} - UPLOAD: false - ENRICH: true + # dev dependencies are build tooling and are not shipped in the UI bundle + run: | + npx --yes @cyclonedx/[email protected] --package-lock-only --omit dev \ + --spec-version 1.6 --output-format JSON --output-file sbom.ui.cdx.json ui/package.json - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -62,7 +62,7 @@ jobs: uses: ./.github/actions/setup-env - name: Generate Java SBOM - run: mvn -B -ntp -Dnoredist org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom + run: mvn -B -ntp -Dnoredist -Psbom validate - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -100,17 +100,14 @@ jobs: " > marvin-install-requires.txt python3 -m venv marvin-venv marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt - marvin-venv/bin/pip freeze > marvin-requirements.txt - name: Generate marvin SBOM - uses: sbomify/sbomify-action@master - env: - LOCK_FILE: marvin-requirements.txt - OUTPUT_FILE: sbom.marvin.cdx.json - COMPONENT_NAME: cloudstack-marvin - COMPONENT_VERSION: ${{ github.ref_name }} - UPLOAD: false - ENRICH: true + # the generator gets its own venv so it doesn't end up in marvin's SBOM + run: | + python3 -m venv sbom-venv + sbom-venv/bin/pip install --quiet cyclonedx-bom==7.5.0 + sbom-venv/bin/cyclonedx-py environment --spec-version 1.6 --output-format JSON \ + --output-file sbom.marvin.cdx.json marvin-venv/bin/python - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: diff --git a/pom.xml b/pom.xml index fb0f593ad58..e6bae4c9851 100644 --- a/pom.xml +++ b/pom.xml @@ -877,33 +877,6 @@ </execution> </executions> </plugin> - <plugin> - <groupId>org.cyclonedx</groupId> - <artifactId>cyclonedx-maven-plugin</artifactId> - <version>2.9.1</version> - <executions> - <execution> - <phase>package</phase> - <inherited>false</inherited> - <goals> - <goal>makeAggregateBom</goal> - </goals> - </execution> - </executions> - <configuration> - <projectType>application</projectType> - <schemaVersion>1.6</schemaVersion> - <includeBomSerialNumber>true</includeBomSerialNumber> - <includeCompileScope>true</includeCompileScope> - <includeProvidedScope>true</includeProvidedScope> - <includeRuntimeScope>true</includeRuntimeScope> - <includeSystemScope>true</includeSystemScope> - <includeTestScope>false</includeTestScope> - <includeLicenseText>false</includeLicenseText> - <outputFormat>all</outputFormat> - <outputName>ACS.sbom</outputName> - </configuration> - </plugin> </plugins> <pluginManagement> <plugins> @@ -1316,6 +1289,47 @@ <module>systemvm</module> </modules> </profile> + <profile> + <!-- Writes target/ACS.sbom.{json,xml}: mvn -Psbom validate (add -Dnoredist to include those modules). + makeAggregateBom resolves the whole reactor from the root, so no modules need to be built first. --> + <id>sbom</id> + <activation> + <property> + <name>sbom</name> + </property> + </activation> + <build> + <plugins> + <plugin> + <groupId>org.cyclonedx</groupId> + <artifactId>cyclonedx-maven-plugin</artifactId> + <version>2.9.1</version> + <executions> + <execution> + <phase>validate</phase> + <inherited>false</inherited> + <goals> + <goal>makeAggregateBom</goal> + </goals> + </execution> + </executions> + <configuration> + <projectType>application</projectType> + <schemaVersion>1.6</schemaVersion> + <includeBomSerialNumber>true</includeBomSerialNumber> + <includeCompileScope>true</includeCompileScope> + <includeProvidedScope>true</includeProvidedScope> + <includeRuntimeScope>true</includeRuntimeScope> + <includeSystemScope>true</includeSystemScope> + <includeTestScope>false</includeTestScope> + <includeLicenseText>false</includeLicenseText> + <outputFormat>all</outputFormat> + <outputName>ACS.sbom</outputName> + </configuration> + </plugin> + </plugins> + </build> + </profile> <profile> <id>eclipse</id> <properties>
