Repository navigation
sbom - #12570
sbom#12570
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests.
Additional details and impacted files@@ Coverage Diff @@
## main #12570 +/- ##
=============================================
- Coverage 17.89% 3.68% -14.22%
=============================================
Files 5936 452 -5484
Lines 532734 38385 -494349
Branches 65165 7102 -58063
=============================================
- Hits 95347 1414 -93933
+ Misses 426711 36784 -389927
+ Partials 10676 187 -10489
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #12570 +/- ##
============================================
- Coverage 20.76% 20.76% -0.01%
Complexity 21903 21903
============================================
Files 6496 6496
Lines 591612 591612
Branches 72585 72585
============================================
- Hits 122851 122836 -15
- Misses 455424 455447 +23
+ Partials 13337 13329 -8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@ppkarwasz @raboof , can you help move this forwards? ;) |
|
no production code... |
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
5 open issues
[0-9]+.[0-9]+.[0-9]+*… · New@masterexecutes a moving target in CI, which is a supply-chain risk and can break builds… · Newsbomify/sbomify-action@mastershould be pinned to a commit SHA… · Newpackagephase will run on every Maven package build… · New
What changed in this PR
Adds initial support for generating CycloneDX SBOMs across UI (npm), Java (Maven), and Marvin (Python) components via Maven configuration and a GitHub Actions workflow.
Changes:
- Add CycloneDX Maven plugin configuration to generate an aggregate Java SBOM.
- Introduce a GitHub Actions workflow to generate and upload SBOM artifacts for UI, Java, and Marvin.
- Add dependency resolution logic for Marvin to produce a lock-like frozen requirements list for SBOM generation.
| File | Description |
|---|---|
| pom.xml | Adds CycloneDX Maven plugin configuration to produce an aggregate SBOM during Maven builds. |
| .github/workflows/sbom.yml | New workflow to generate SBOMs for UI/Java/Marvin and upload them as artifacts on tag pushes or manual runs. |
Review effort: Lite
| on: | ||
| push: | ||
| tags: | ||
| - '[0-9]+.[0-9]+.[0-9]+*' |
| - name: Generate UI SBOM | ||
| uses: sbomify/sbomify-action@master | ||
| env: | ||
| LOCK_FILE: ui/package-lock.json | ||
| OUTPUT_FILE: sbom.ui.cdx.json | ||
| COMPONENT_NAME: cloudstack-ui | ||
| COMPONENT_VERSION: ${{ github.ref_name }} | ||
| UPLOAD: false | ||
| ENRICH: true |
| - name: Generate marvin SBOM | ||
| uses: sbomify/sbomify-action@master | ||
| env: | ||
| LOCK_FILE: marvin-requirements.txt | ||
| OUTPUT_FILE: sbom.marvin.cdx.json | ||
| COMPONENT_NAME: cloudstack-marvin | ||
| COMPONENT_VERSION: ${{ github.ref_name }} | ||
| UPLOAD: false | ||
| ENRICH: true |
| <phase>package</phase> | ||
| <inherited>false</inherited> | ||
| <goals> | ||
| <goal>makeAggregateBom</goal> | ||
| </goals> |
| <configuration> | ||
| <projectType>application</projectType> | ||
| <schemaVersion>1.6</schemaVersion> | ||
| <includeBomSerialNumber>true</includeBomSerialNumber> |
|
Sorry, I missed this notification. I'll try to look at it this week. |
Description
This PR experiments with sboms (we have JS/VueJs, python, java and also dependencies on different systems. This PR is intended to see if automated Software Bills Of Material can be generated in a concise unified manner for components and maybe for install options..
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?