Skip to content

CI: add CycloneDX SBOM generation for releases #7698

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
neteler wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

CI: add CycloneDX SBOM generation for releases #7698

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ed5116a
CI: add CycloneDX SBOM generation for releases
neteler Jul 14, 2026
8ccba36
file naming improvements (apply suggestions from code review)
neteler Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/create_release_draft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,15 @@ jobs:
xz -9e "${GRASS}.tar"
md5sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.md5"
sha256sum "${GRASS}.tar.xz" > "${GRASS}.tar.xz.sha256"
- name: Generate CycloneDX SBOM
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
path: .
format: cyclonedx-json
output-file: ${{ env.OUT_DIR }}/grass.cdx.json
artifact-name: grass.cdx.json
upload-artifact: true
upload-release-assets: false
- name: Publish draft distribution to GitHub (for tags only)
if: startsWith(github.ref, 'refs/tags/')
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
Expand All @@ -93,3 +102,4 @@ jobs:
${{ env.OUT_DIR }}/${{ env.GRASS }}.tar.xz.sha256
${{ env.OUT_DIR }}/ChangeLog.gz
${{ env.OUT_DIR }}/core_modules_with_last_commit.patch
${{ env.OUT_DIR }}/grass.cdx.json
39 changes: 39 additions & 0 deletions .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
---
name: Generate SBOM

on:
workflow_dispatch:
inputs:
source-path:
description: Path to scan for SBOM generation
required: false
default: '.'
output-file:
description: Output SBOM file name
required: false
default: 'grass.cyclonedx.json'
Comment on lines +5 to +14

@wenzeslaus wenzeslaus Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the release workflow generating the SBOM (and uploading it as a workflow artifact on check runs, if the suggestion there is applied), the remaining use of this workflow would be ad-hoc generation for an arbitrary ref — but workflow_dispatch runs the workflow file from the selected ref, so branches without this file cannot be dispatched anyway. Suggest dropping this file (and the corresponding SECURITY.md bullet) in favor of the release step and make sbom.

If it is kept, the inputs add little: the workflow scans a fresh checkout, so source-path would only produce a partial SBOM of a subdirectory, a case better served by running Syft locally. And output-file has no observable effect here — nothing in this workflow reads the written file; the only retrievable result is the uploaded artifact, whose file name comes from artifact-name, not output-file.

Suggested change
workflow_dispatch:
inputs:
source-path:
description: Path to scan for SBOM generation
required: false
default: '.'
output-file:
description: Output SBOM file name
required: false
default: 'grass.cyclonedx.json'
workflow_dispatch:


concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions: {}

jobs:
generate:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Generate CycloneDX SBOM
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
path: .
format: cyclonedx-json
artifact-name: grass.cdx.json
upload-artifact: true
upload-release-assets: false
13 changes: 12 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,8 +123,19 @@ code-coverage-clean:
-find . -type f \( -name "*.gcda" -o -name "*.gcno" -o -name "*.gcov" \) -delete
-rm -f .coverage

sbom:

@wenzeslaus wenzeslaus Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On main, Autotools and CMake are kept equivalent, so a CMake counterpart is needed. Tested locally (CMake configure and cmake --build build --target sbom with Syft 1.46.0): the SBOM is written to the build directory, which keeps the source tree clean and needs no cleaning rules on the CMake side. At the end of the top-level CMakeLists.txt:

 install(FILES ${CMAKE_CURRENT_BINARY_DIR}/GRASSConfig.cmake
               ${CMAKE_CURRENT_BINARY_DIR}/GRASSConfigVersion.cmake
         DESTINATION ${GRASS_INSTALL_CMAKECONFDIR}/GRASS)
 
+find_program(SYFT syft)
+if(SYFT)
+  add_custom_target(
+    sbom
+    COMMAND ${SYFT} dir:${CMAKE_SOURCE_DIR} -o
+            cyclonedx-json=${CMAKE_BINARY_DIR}/grass.cdx.json
+    COMMENT "Generating CycloneDX SBOM using Syft")
+  set_target_properties(sbom PROPERTIES FOLDER Misc)
+endif()
+
 set_property(GLOBAL PROPERTY USE_FOLDERS YES)

@if command -v syft > /dev/null 2>&1; then \
echo "Generating CycloneDX SBOM using Syft..."; \
syft dir:. -o cyclonedx-json=grass.cdx.json; \
echo "SBOM written to grass.cdx.json"; \
else \
echo "Syft not found. Install it from https://github.com/anchore/syft" >&2; \
exit 1; \
fi
Comment thread
neteler marked this conversation as resolved.
Resolved

distclean: clean
-rm -f config.cache config.log config.status config.status.$(ARCH) 2>/dev/null
Comment thread
neteler marked this conversation as resolved.
Resolved
-rm -f grass.cdx.json
-rm -f ChangeLog ChangeLog.bak $(ERRORLOG) grass.pc
-rm -f include/grass/config.h include/grass/version.h
-rm -f include/Make/Platform.make include/Make/Doxyfile_arch_html include/Make/Doxyfile_arch_latex 2>/dev/null
Expand All @@ -136,5 +147,5 @@ include $(MODULE_TOPDIR)/include/Make/Sphinx.make

DOXNAME=grass

.PHONY: default libs
.PHONY: default libs sbom
.PHONY: cleandistdirs cleanscriptstrings clean libsclean distclean
19 changes: 19 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,4 +55,23 @@ in allowing us time to address any reported vulnerabilities before disclosing
them publicly. We ask that you refrain from disclosing any details of the
vulnerability until we have had adequate time to provide a fix.

## Software Bill of Materials (SBOM)

GRASS publishes a CycloneDX SBOM with every official release.

- The SBOM is generated automatically in CI via [Syft](https://github.com/anchore/syft)
and attached as `grass.cdx.json` to each GitHub release draft.
It covers dependencies declared in the source tree (Python package
requirements); components linked at build time (GDAL, PROJ, GEOS,
etc.) are resolved only in built artifacts and appear in the Docker
image SBOMs where they are installed from OS package repositories.
- For Docker images, an SBOM is embedded at build time (`sbom: true` in
`docker/build-push-action`) and attestations are published via
`actions/attest-build-provenance`.
Comment on lines +68 to +70

@wenzeslaus wenzeslaus Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Docker workflow uses actions/attest, not actions/attest-build-provenance (only a stale permissions comment mentions the latter). The workflow details are visible in the CI files and go stale when they change; readers here need the facts, not the mechanism:

Suggested change
- For Docker images, an SBOM is embedded at build time (`sbom: true` in
`docker/build-push-action`) and attestations are published via
`actions/attest-build-provenance`.
- For Docker images, an SBOM is embedded in the image at build time and
build attestations are published.

- To generate an SBOM locally, install Syft and run `make sbom` from the
repository root.
Comment on lines +71 to +72

@wenzeslaus wenzeslaus Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the CMake target from the Makefile comment is added:

Suggested change
- To generate an SBOM locally, install Syft and run `make sbom` from the
repository root.
- To generate an SBOM locally, install Syft and run `make sbom` from the
repository root, or build the `sbom` target with CMake
(`cmake --build <build dir> --target sbom`).

- SBOM generation can also be triggered manually via the
[Generate SBOM](https://github.com/OSGeo/grass/actions/workflows/sbom.yml)
workflow on GitHub Actions.

Thank you for helping to keep GRASS secure!
Loading