chore: add SBOM release workflow and ADRs - #764
Conversation
michaeldcanady
added
the
no-issue-required
github-actions
Bot
added
type: documentation
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| echo "::notice::No GitHub Release found for tag ${GITHUB_REF#refs/tags/}. " | ||
| echo "The SBOM was generated at ./sbom.spdx.json but was not attached to a release." | ||
| echo "Ensure the tag was created by the release-please process " | ||
| "or manually create a release draft." No newline at end of file |
There was a problem hiding this comment.
Shell syntax error: the last line is a bare quoted string used as a command, so the step will fail with "or manually create a release draft.": command not found. The intent was clearly to continue the previous echo message. Fix by merging into a single echo:
echo "Ensure the tag was created by the release-please process or manually create a release draft."
| run: syft . -o spdx > sbom.spdx.json | ||
|
|
||
| - name: Upload SBOM to release | ||
| uses: actions/upload-release-asset@v1 |
There was a problem hiding this comment.
actions/upload-release-asset is archived on GitHub and its @v1 runtime is node12, which GitHub-hosted runners no longer support — the step will fail to run. It also does NOT accept a tag_name input: its required input is upload_url (the asset endpoint URL), so tag_name: ${{ github.ref_name }} here will be rejected and upload_url will be missing. This workflow will not attach anything. Prefer a maintained action that resolves releases by tag, e.g. softprops/action-gh-release (pin to a SHA / tagged release) with files: sbom.spdx.json, or the gh release CLI:
run: gh release upload "${{ github.ref_name }}" sbom.spdx.json --clobberNote also that sbom.yml in this same PR already uploads sbom.spdx.json to the same release on the same tag trigger — see the duplication comment.
| on: | ||
| push: | ||
| tags: | ||
| - "v*" |
There was a problem hiding this comment.
There are two workflows in this PR - sbom.yml and sbom-release.yml - that both trigger on 'v*' tag pushes, both generate a file named sbom.spdx.json, and both upload that same-named asset to the same GitHub release. On a real tag push they run concurrently and race to create/overwrite the single sbom.spdx.json asset (a second upload of an existing asset name fails with a 422, while the other deletes-then-reuploads). Ship exactly one workflow; delete the other. sbom.yml is the more complete one (deletes + re-uploads), so sbom-release.yml is likely redundant - but note sbom-release.yml cannot work at all anyway (see its upload step comment).
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Syft | ||
| uses: anchore/syft-action@master |
There was a problem hiding this comment.
Supply-chain / security: anchore/syft-action@master is a moving ref (not pinned to a SHA or tagged release) and syft-version: 'latest' installs an unpinned tool version. This repo pins every action to a commit SHA (see zizmor.yml/ci.yml) and runs zizmor + scorecard audits; a moving @master + latest dependency will be flagged and defeats reproducibility. Pin the action to a SHA and a fixed syft version (or install syft at a pinned version).
|
All six inline comments are posted. The review is complete. Here is my summary. SummaryRequesting changes This PR adds SBOM generation/attachment to releases plus two ADRs. The SBOM automation has real correctness and security problems that must be fixed before it will actually work — or be safe — in this repo.
The recommended consolidation: keep a single workflow (the fuller |
- Single sbom.yml workflow replaces duplicate sbom-release.yml - Pinned syft version (v1.41.0) for supply-chain integrity - Uses gh-token GITHUB_TOKEN for release asset management - Idempotent: deletes existing SBOM asset before re-upload - Fixed shell syntax (no stray quoted string) - Runs on v* tag pushes only
15b866c to
d1511b1
Compare
github-actions
Bot
removed
the
type: documentation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
/oc review |
|
|
||
| - name: Install Syft (pinned version) | ||
| run: | | ||
| curl -sSfL https://raw.githubusercontent.com/anchore/syft/v$SYFT_VERSION/install.sh | sh -s -- -b /usr/local/bin |
There was a problem hiding this comment.
SYFT_VERSION is never set in this step, so the install URL is broken. The env: SYFT_VERSION: v1.41.0 is declared only on the next step ("Generate SBOM", lines 43-44). Here it is unset, so the URL resolves to raw.githubusercontent.com/anchore/syft/v/install.sh, which 404s and the step fails. Move the env (or a hard-coded version) onto this Install step. Note also that even if it were set here, v$SYFT_VERSION with value v1.41.0 would expand to vv1.41.0 — drop the leading v from the value or from the URL template.
| echo "::notice::No GitHub Release found for tag ${GITHUB_REF#refs/tags/}. " | ||
| echo "The SBOM was generated at ./sbom.spdx.json but was not attached to a release." | ||
| echo "Ensure the tag was created by the release-please process " | ||
| "or manually create a release draft." No newline at end of file |
There was a problem hiding this comment.
Shell syntax error: a bare quoted string on its own line. Line 93 is a stray "or manually create a release draft." used as a command, so this step will fail with command not found (and the preceding notice is split across two echoes). Merge it into the previous line:
echo "Ensure the tag was created by the release-please process or manually create a release draft."
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
Unpinned actions deviate from the repo convention. Every action in this repo is pinned to a commit SHA with a # vX.Y.Z comment (see ci.yml: actions/checkout@3d3c42... # v7.0.1, actions/setup-go@b7ad1dad... # v7.0.0), and the zizmor/scorecard CI enforces that. actions/checkout@v4 and actions/setup-go@v5 here use moving minor tags and will both be flagged. Pin both to a commit SHA with the version comment.
|
|
||
| - name: Install Syft (pinned version) | ||
| run: | | ||
| curl -sSfL https://raw.githubusercontent.com/anchore/syft/v$SYFT_VERSION/install.sh | sh -s -- -b /usr/local/bin |
There was a problem hiding this comment.
Supply-chain: curl-pipe-to-sh from a moving URL with no integrity check. This pipes install.sh fetched from raw.githubusercontent.com/anchore/syft/v$SYFT_VERSION/install.sh straight into sh, with no pinned version in this step and no checksum verification -- a supply-chain anti-pattern the repo zizmor/scorecard posture and SHA-pinning convention expects you to avoid. Prefer a SHA-pinned action (e.g. anchore/syft-action pinned to a commit hash for a fixed syft version) or download the exact-version release asset and verify its checksum. This also combines with the SYFT_VERSION scoping bug on the same line -- fix both together.
|
All four inline comments posted. I have two verified actionable shell/correctness bugs (SYFT_VERSION scoping + line 93), plus the supply-chain/pinning deviations (curl|sh, unpinned actions) which align with the zizmor findings already on the PR. I rated these as genuine — the SYFT_VERSION scoping bug is the most important because the workflow cannot run as written. Here's my final review summary: Requesting changes This workflow cannot run successfully as written — there's a scoping bug that breaks the syft install, plus a shell syntax error, and the unpinned dependencies contradict the repo's zizmor/scorecard posture.
Fix the install scoping + the trailing shell line (both are hard failures) and align pinning, then this is solid. |
Resolve the issues that blocked PR #764: fix the stray quoted string in the final run block, move the syft SYFT_VERSION env onto the install step and drop its double-v, SHA-pin checkout and drop the unused setup-go step, and replace the moving curl|sh syft install with a pinned release download verified against its published checksum. Scope release-upload permissions to the job and move RELEASE_ID into env to silence zizmor. The workflow now passes zizmor with no findings. Co-authored-by: opencode <opencode@local>
Resolve the issues that blocked PR #764: fix the stray quoted string in the final run block, move the syft SYFT_VERSION env onto the install step and drop its double-v, SHA-pin checkout and drop the unused setup-go step, and replace the moving curl|sh syft install with a pinned release download verified against its published checksum. Scope release-upload permissions to the job and move RELEASE_ID into env to silence zizmor. The workflow now passes zizmor with no findings. Co-authored-by: opencode <opencode@local>
|
Closing in favor of #765 (identical change on the validly-named branch |
* chore: add consolidated SBOM generation workflow - Single sbom.yml workflow replaces duplicate sbom-release.yml - Pinned syft version (v1.41.0) for supply-chain integrity - Uses gh-token GITHUB_TOKEN for release asset management - Idempotent: deletes existing SBOM asset before re-upload - Fixed shell syntax (no stray quoted string) - Runs on v* tag pushes only * chore(ci): fix SBOM workflow blocking review findings Resolve the issues that blocked PR #764: fix the stray quoted string in the final run block, move the syft SYFT_VERSION env onto the install step and drop its double-v, SHA-pin checkout and drop the unused setup-go step, and replace the moving curl|sh syft install with a pinned release download verified against its published checksum. Scope release-upload permissions to the job and move RELEASE_ID into env to silence zizmor. The workflow now passes zizmor with no findings. Co-authored-by: opencode <opencode@local> --------- Co-authored-by: opencode <opencode@local>
* chore: add consolidated SBOM generation workflow - Single sbom.yml workflow replaces duplicate sbom-release.yml - Pinned syft version (v1.41.0) for supply-chain integrity - Uses gh-token GITHUB_TOKEN for release asset management - Idempotent: deletes existing SBOM asset before re-upload - Fixed shell syntax (no stray quoted string) - Runs on v* tag pushes only * chore(ci): fix SBOM workflow blocking review findings Resolve the issues that blocked PR #764: fix the stray quoted string in the final run block, move the syft SYFT_VERSION env onto the install step and drop its double-v, SHA-pin checkout and drop the unused setup-go step, and replace the moving curl|sh syft install with a pinned release download verified against its published checksum. Scope release-upload permissions to the job and move RELEASE_ID into env to silence zizmor. The workflow now passes zizmor with no findings. Co-authored-by: opencode <opencode@local> --------- Co-authored-by: opencode <opencode@local>
2 participants
chore: add consolidated SBOM generation workflow