Copilot commented on code in PR #12570: URL: https://github.com/apache/cloudstack/pull/12570#discussion_r4444940999
########## .github/workflows/sbom.yml: ########## @@ -0,0 +1,118 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: generate sboms + +on: + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+*' Review Comment: GitHub Actions tag filters use glob patterns (not regex). The pattern `[0-9]+.[0-9]+.[0-9]+*` matches literal `+` characters and is unlikely to match normal version tags like `4.20.0`. Use a glob that matches your tag format (e.g., `[0-9]*.[0-9]*.[0-9]*` or `v[0-9]*.[0-9]*.[0-9]*` depending on how tags are named). ########## .github/workflows/sbom.yml: ########## @@ -0,0 +1,118 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: generate sboms + +on: + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+*' + workflow_dispatch: + +permissions: + contents: read + +jobs: + ui-sbom: + name: ui sbom + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Generate UI SBOM + uses: sbomify/sbomify-action@master + env: + LOCK_FILE: ui/package-lock.json + OUTPUT_FILE: sbom.ui.cdx.json + COMPONENT_NAME: cloudstack-ui + COMPONENT_VERSION: ${{ github.ref_name }} + UPLOAD: false + ENRICH: true Review Comment: Using `@master` executes a moving target in CI, which is a supply-chain risk and can break builds unexpectedly. Pin this action to an immutable ref (commit SHA, or at least a specific release tag) and update via controlled bumps. ########## .github/workflows/sbom.yml: ########## @@ -0,0 +1,118 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: generate sboms + +on: + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+*' + workflow_dispatch: + +permissions: + contents: read + +jobs: + ui-sbom: + name: ui sbom + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Generate UI SBOM + uses: sbomify/sbomify-action@master + env: + LOCK_FILE: ui/package-lock.json + OUTPUT_FILE: sbom.ui.cdx.json + COMPONENT_NAME: cloudstack-ui + COMPONENT_VERSION: ${{ github.ref_name }} + UPLOAD: false + ENRICH: true + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sbom-ui + path: sbom.ui.cdx.json + + java-sbom: + name: java sbom + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Environment + uses: ./.github/actions/setup-env + + - name: Generate Java SBOM + run: mvn -B -ntp -Dnoredist org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: sbom-java + path: target/ACS.sbom.* + + marvin-sbom: + name: marvin sbom + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Setup Environment + uses: ./.github/actions/setup-env + with: + install-python: 'true' + + - name: Resolve marvin dependencies + run: | + # marvin's `packages` list includes the generated marvin.cloudstackAPI + # module, which is created at build time from the API spec and isn't + # checked in, so setup.py can't be built directly. Read the declared + # install_requires instead of building the package. + python3 -c " + import ast + tree = ast.parse(open('tools/marvin/setup.py').read()) + for node in ast.walk(tree): + if isinstance(node, ast.Call) and getattr(node.func, 'id', None) == 'setup': + for kw in node.keywords: + if kw.arg == 'install_requires': + for elt in kw.value.elts: + print(elt.value) + " > marvin-install-requires.txt + python3 -m venv marvin-venv + marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt + marvin-venv/bin/pip freeze > marvin-requirements.txt + + - name: Generate marvin SBOM + uses: sbomify/sbomify-action@master + env: + LOCK_FILE: marvin-requirements.txt + OUTPUT_FILE: sbom.marvin.cdx.json + COMPONENT_NAME: cloudstack-marvin + COMPONENT_VERSION: ${{ github.ref_name }} + UPLOAD: false + ENRICH: true Review Comment: Same issue as the UI SBOM step: `sbomify/sbomify-action@master` should be pinned to a commit SHA (or a specific, immutable release tag) to reduce supply-chain risk. ########## pom.xml: ########## @@ -877,6 +877,33 @@ </execution> </executions> </plugin> + <plugin> + <groupId>org.cyclonedx</groupId> + <artifactId>cyclonedx-maven-plugin</artifactId> + <version>2.9.1</version> + <executions> + <execution> + <phase>package</phase> + <inherited>false</inherited> + <goals> + <goal>makeAggregateBom</goal> + </goals> Review Comment: Binding SBOM generation to the default `package` phase will run on every Maven package build (including developer builds and CI lanes that don’t need SBOMs), increasing build time and producing extra artifacts. Consider moving this execution behind a Maven profile (e.g., activated via `-Psbom` or `-Dsbom`) so SBOM generation is explicit and isolated to the sbom workflow/release process. ########## pom.xml: ########## @@ -877,6 +877,33 @@ </execution> </executions> </plugin> + <plugin> + <groupId>org.cyclonedx</groupId> + <artifactId>cyclonedx-maven-plugin</artifactId> + <version>2.9.1</version> + <executions> + <execution> + <phase>package</phase> + <inherited>false</inherited> + <goals> + <goal>makeAggregateBom</goal> + </goals> + </execution> + </executions> + <configuration> + <projectType>application</projectType> + <schemaVersion>1.6</schemaVersion> + <includeBomSerialNumber>true</includeBomSerialNumber> Review Comment: Including a BOM serial number typically makes the SBOM non-deterministic between runs (new UUID each build), which creates noisy diffs and complicates reproducibility/verification. If reproducible artifacts are desired, consider disabling this (or otherwise ensuring stable SBOM identifiers) for CI-generated SBOMs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
