Ship CycloneDX SBOM with every GitHub release - #2195
Merged
Conversation
Generate a CycloneDX 1.x JSON Software Bill of Materials once per release on the linux-x64 lane via the pinned `dotnet-CycloneDX` global tool (`--version 6.2.0`, run with `--output-format Json`, `--exclude-test-projects`, and a stable filename of `cdidx.sbom.cdx.json`), upload it as a `CodeIndex-sbom` build artifact, copy it into `release-files/` alongside the tarballs/zips so the existing `sha256sums.txt` covers it, and ship it as a release asset. Extend the asset-collection glob in `create-release` to also match `*.cdx.json` so the SBOM gets included. The SBOM lists every NuGet dependency including the bundled `Microsoft.Data.Sqlite` / `SQLitePCLRaw` graph and the native `e_sqlite3` asset, so SOC2 / FedRAMP-style compliance reviews and supply-chain scanners (Snyk, Trivy, Grype) can audit transitive dependencies without re-deriving them from the .NET-specific `.deps.json`. The CycloneDX tool runs only on the CI release runner and never lands in the shipped binary, so the production runtime-dependency policy is unchanged. Add a "Verifying releases" section to `README.md` (English and Japanese) covering the SBOM location, intended consumers, and a `sha256sum --check` quick-verify command, and extend the `DEVELOPER_GUIDE.md` release "moving parts" table to document the SBOM alongside the existing per-RID binaries and `sha256sums.txt`. Cover the workflow contract with two release-workflow assertions (`Install CycloneDX SBOM tool`, `dotnet-CycloneDX` invocation with the modern flag surface, `--exclude-test-projects`, `cdidx.sbom.cdx.json`, `CodeIndex-sbom`, the `linux-x64`-only gate, and the `*.cdx.json` glob clause) so accidental flag drift (e.g. `--json` to `--output-format Json` between CycloneDX majors) or removal of the SBOM step fails CI loudly.
actions/setup-dotnet@v4 does not put $HOME/.dotnet/tools on PATH for subsequent steps, so `dotnet tool install --global CycloneDX` succeeds but the next step invoking `dotnet-CycloneDX` would fail with "command not found" on GitHub-hosted runners. Append the directory to $GITHUB_PATH in the same step so the SBOM-generation step can resolve the binary. actions/setup-dotnet@v4 は $HOME/.dotnet/tools を後続 step の PATH に 自動では含めないため、`dotnet tool install --global CycloneDX` は 成功するが、次の step での `dotnet-CycloneDX` 呼び出しが `command not found` で失敗してしまう。インストールと同じ step 内で $GITHUB_PATH に当該ディレクトリを追記し、SBOM 生成 step から コマンドを解決できるようにする。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cdidx.sbom.cdx.json) once per release on thelinux-x64matrix lane via the pinneddotnet-CycloneDXglobal tool (--version 6.2.0,--output-format Json,--exclude-test-projects), upload it as theCodeIndex-sbomartifact, copy it intorelease-files/sosha256sums.txtcovers its hash, and ship it as a release asset alongside the per-RID tarballs/zips. Extend the asset-collection glob increate-releaseto also match*.cdx.json.Microsoft.Data.Sqlite/SQLitePCLRawgraph and the nativee_sqlite3asset), so SOC2 / FedRAMP-style compliance reviews and supply-chain scanners (Snyk, Trivy, Grype) can audit transitive dependencies without re-deriving them from the .NET-specific.deps.json. The CycloneDX tool only runs on the CI release runner and never lands in the shipped binary, so the production runtime-dependency policy is unchanged.$HOME/.dotnet/toolsto$GITHUB_PATHin the install step becauseactions/setup-dotnet@v4does not put the global-tools directory on PATH for subsequent steps on GitHub-hosted runners.Validation
dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ReleaseWorkflowTests"— passes (2/2).ReleaseWorkflow_GeneratesCycloneDxSbomAndShipsItAsReleaseAssetasserts the pinned--version 6.2.0, thedotnet-CycloneDX src/CodeIndex/CodeIndex.csprojinvocation, the modern--output-format Jsonand--exclude-test-projectsflag surface, the stable filenamecdidx.sbom.cdx.json, theCodeIndex-sbomartifact name, thematrix.rid == 'linux-x64'gate, and the*.cdx.jsonglob clause increate-release, so accidental flag drift (e.g.--json→--output-format Jsonbetween CycloneDX majors) or removal of the SBOM step fails CI loudly.v*tag.Documentation / Changelog
changelog.d/unreleased/1553.added.md(bilingualaddedcategory).README.md(English + Japanese): new "Verifying releases / リリース成果物の検証" section documenting the SBOM location, intended consumers, and asha256sum --checkquick-verify command.DEVELOPER_GUIDE.md(English + Japanese): release "moving parts" table extended with the SBOM row alongside the existing per-RID binaries andsha256sums.txt.Follow-up candidates
Fixes #1553