From db95289afaa1ec8a42f64b3950bbd859ff167fbd Mon Sep 17 00:00:00 2001 From: Daan Hoogland Date: Tue, 3 Feb 2026 10:08:45 +0100 Subject: [PATCH 1/3] sbom --- .github/workflows/sbom.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/sbom.yml diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml new file mode 100644 index 000000000000..d57a5ea78b6f --- /dev/null +++ b/.github/workflows/sbom.yml @@ -0,0 +1,23 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +- uses: sbomify/github-action@master + env: + LOCK_FILE: ui/package-lock.json + OUTPUT_FILE: sbom.ui.cdx.json + UPLOAD: false + ENRICH: true From e9fd21771b450e16e9805360bc539f93fc451ca5 Mon Sep 17 00:00:00 2001 From: Daan Hoogland Date: Tue, 3 Feb 2026 15:02:11 +0100 Subject: [PATCH 2/3] spom --- .github/workflows/sbom.yml | 19 +++++++++++++------ pom.xml | 26 ++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 6 deletions(-) diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index d57a5ea78b6f..4ed44d32602b 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -15,9 +15,16 @@ # specific language governing permissions and limitations # under the License. -- uses: sbomify/github-action@master - env: - LOCK_FILE: ui/package-lock.json - OUTPUT_FILE: sbom.ui.cdx.json - UPLOAD: false - ENRICH: true +name: generate sboms + +jobs: + build: + name: ui sbom + uses: sbomify/github-action@master + env: + LOCK_FILE: ui/package-lock.json + OUTPUT_FILE: sbom.ui.cdx.json + COMPONENT_NAME: my-app + COMPONENT_VERSION: ${{ github.ref_name }} + UPLOAD: false + ENRICH: true diff --git a/pom.xml b/pom.xml index 883e7a4e4db6..ff7d533cfbc4 100644 --- a/pom.xml +++ b/pom.xml @@ -848,6 +848,32 @@ + + org.cyclonedx + cyclonedx-maven-plugin + 2.9.1 + + + package + + makeAggregateBom + + + + + application + 1.6 + true + true + true + true + true + false + false + all + ACS.sbom + + From 17f594362758fe9ac7a4f4e84bface959ca6ac9a Mon Sep 17 00:00:00 2001 From: Daan Hoogland Date: Wed, 26 Aug 2026 16:31:41 +0200 Subject: [PATCH 3/3] sboms for java, ui, and marvin code --- .github/workflows/sbom.yml | 106 +++++++++++++++++++++++++++++++++---- pom.xml | 1 + 2 files changed, 98 insertions(+), 9 deletions(-) diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 4ed44d32602b..d368c0e4e313 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -17,14 +17,102 @@ name: generate sboms +on: + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+*' + workflow_dispatch: + +permissions: + contents: read + jobs: - build: + ui-sbom: name: ui sbom - uses: sbomify/github-action@master - env: - LOCK_FILE: ui/package-lock.json - OUTPUT_FILE: sbom.ui.cdx.json - COMPONENT_NAME: my-app - COMPONENT_VERSION: ${{ github.ref_name }} - UPLOAD: false - ENRICH: true + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Generate UI SBOM + uses: sbomify/sbomify-action@master + env: + LOCK_FILE: ui/package-lock.json + OUTPUT_FILE: sbom.ui.cdx.json + COMPONENT_NAME: cloudstack-ui + COMPONENT_VERSION: ${{ github.ref_name }} + UPLOAD: false + ENRICH: true + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sbom-ui + path: sbom.ui.cdx.json + + java-sbom: + name: java sbom + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Environment + uses: ./.github/actions/setup-env + + - name: Generate Java SBOM + run: mvn -B -ntp -Dnoredist org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sbom-java + path: target/ACS.sbom.* + + marvin-sbom: + name: marvin sbom + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Environment + uses: ./.github/actions/setup-env + with: + install-python: 'true' + + - name: Resolve marvin dependencies + run: | + # marvin's `packages` list includes the generated marvin.cloudstackAPI + # module, which is created at build time from the API spec and isn't + # checked in, so setup.py can't be built directly. Read the declared + # install_requires instead of building the package. + python3 -c " + import ast + tree = ast.parse(open('tools/marvin/setup.py').read()) + for node in ast.walk(tree): + if isinstance(node, ast.Call) and getattr(node.func, 'id', None) == 'setup': + for kw in node.keywords: + if kw.arg == 'install_requires': + for elt in kw.value.elts: + print(elt.value) + " > marvin-install-requires.txt + python3 -m venv marvin-venv + marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt + marvin-venv/bin/pip freeze > marvin-requirements.txt + + - name: Generate marvin SBOM + uses: sbomify/sbomify-action@master + env: + LOCK_FILE: marvin-requirements.txt + OUTPUT_FILE: sbom.marvin.cdx.json + COMPONENT_NAME: cloudstack-marvin + COMPONENT_VERSION: ${{ github.ref_name }} + UPLOAD: false + ENRICH: true + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sbom-marvin + path: sbom.marvin.cdx.json diff --git a/pom.xml b/pom.xml index ff7d533cfbc4..14d2688e09a2 100644 --- a/pom.xml +++ b/pom.xml @@ -855,6 +855,7 @@ package + false makeAggregateBom