add custom sbom generation

[mwrock]

No description provided.

[Copilot]

Pull request overview

This PR adds custom SBOM generation for non-Rust, deployable Habitat-packaged components by querying Builder for their core-origin transitive dependencies, then merges that fragment with the Rust (cargo-cyclonedx) SBOM and imports/uploads the combined CycloneDX document from CI.

Changes:

• Add a support/sbom/ Bash script that queries the public Builder API for top-level Habitat package tdeps and emits a CycloneDX 1.4 components list for core-origin deps.
• Extend the CI workflow to generate cargo CycloneDX SBOMs, merge with the Habitat fragment via cyclonedx-cli, filter first-party components, upload an artifact, and import to BlackDuck on non-PR events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
support/sbom/generate-habitat-pkg-deps.sh	New script to produce a CycloneDX fragment of core-origin Habitat runtime dependencies by querying Builder package tdeps.
.github/workflows/ci-main-pull-request-stub.yml	Adds a job to generate/merge CycloneDX SBOMs and import/upload to BlackDuck (pushes), including filtering to keep third-party + Habitat core deps.

Comments suppressed due to low confidence (1)

.github/workflows/ci-main-pull-request-stub.yml:206

• serialNumber is being set to urn:uuid:builder-${BD_VERSION_NAME}, which is not a valid UUID URN per CycloneDX (urn:uuid:<RFC4122-uuid>). Some consumers may reject or ignore it. Generate a real UUID (deterministic per version if you want stability) and use that in the URN.

          jq --arg serial "urn:uuid:builder-${BD_VERSION_NAME}" --arg ver "$BD_VERSION_NAME" \

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

.github/workflows/ci-main-pull-request-stub.yml:208

• serialNumber in a CycloneDX BOM is expected to be a URN UUID (e.g., urn:uuid:<uuid>). Setting it to urn:uuid:builder-${BD_VERSION_NAME} is not a UUID and can cause schema validation / import issues in downstream tools. Generate a real UUID deterministically from BD_VERSION_NAME (UUIDv5) and use that.

          jq --arg serial "urn:uuid:builder-${BD_VERSION_NAME}" --arg ver "$BD_VERSION_NAME" \
            '.serialNumber = $serial
             | .metadata.component.version = $ver

.gitattributes:5

• This new .gitattributes file appears to have CRLF line endings (visible as \r in the view output). Since the goal is to enforce LF endings, please re-save/commit this file itself with LF-only endings to avoid cross-platform churn.

# Ensure shell scripts and GitHub Actions workflow files always use LF line
# endings, even when checked out/edited on Windows. Scripts with CRLF fail at
# runtime on Linux CI runners with errors like:
#   line 1: $'\r': command not found
*.sh text eol=lf

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

.github/workflows/ci-main-pull-request-stub.yml:216

• serialNumber in CycloneDX must be urn:uuid:<RFC4122-uuid>. Using urn:uuid:builder-${BD_VERSION_NAME} produces a non-conformant BOM that may be rejected by validators/tools.

Consider generating a deterministic UUID from the version (UUIDv5) and using that in the URN instead.

          jq --arg serial "urn:uuid:builder-${BD_VERSION_NAME}" --arg ver "$BD_VERSION_NAME" \

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (6)

.github/workflows/ci-main-pull-request-stub.yml:153

• Using dtolnay/rust-toolchain@master makes the workflow non-reproducible and increases supply-chain risk (the action code can change without review). Pin the action to a stable ref (e.g., @v1) while still supplying the toolchain version via the toolchain: input.

        uses: dtolnay/rust-toolchain@master

.github/workflows/ci-main-pull-request-stub.yml:171

• This downloads cyclonedx-cli from the moving releases/latest URL with no integrity verification, which is a supply-chain risk and can break builds if the asset name/format changes. Pin to a specific release and verify the published sha256 digest before executing the binary.

      - name: Install CycloneDX CLI
        run: |
          curl -sSL https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64 \
            -o /usr/local/bin/cyclonedx-cli
          chmod +x /usr/local/bin/cyclonedx-cli

support/sbom/generate-habitat-pkg-deps.sh:33

• This script relies on curl/jq, but currently a missing jq (or curl) can be silently masked (the jq … || true in the mapfile pipeline), leading to misleading “No core-origin packages found” errors. Add an explicit dependency check near the top so failures are immediate and actionable.

set -euo pipefail

BLDR_URL="${BLDR_URL:-https://bldr.habitat.sh}"
CHANNEL="${CHANNEL:-on-prem-base}"
TARGET="${TARGET:-x86_64-linux}"

.github/workflows/ci-main-pull-request-stub.yml:262

• This step uses repository/org secrets. On pull_request events those secrets are unavailable (especially for fork PRs), causing the workflow to fail and/or creating unnecessary exposure risk. Gate the import step (or entire job) so it only runs in trusted contexts (e.g., push).

        # if: github.event_name != 'pull_request'

.github/workflows/ci-main-pull-request-stub.yml:232

• CycloneDX serialNumber must be a valid UUID URN (urn:uuid:<uuid>). Setting it to urn:uuid:builder-${BD_VERSION_NAME} produces an invalid BOM identifier and can cause validation/import issues. Generate a real UUID (deterministically if you want it version-stable).

          jq --arg serial "urn:uuid:builder-${BD_VERSION_NAME}" --arg ver "$BD_VERSION_NAME" \

.gitattributes:7

• This .gitattributes file itself appears to have CRLF line endings, which can cause Git to treat the last attribute on each line as eol=lf\r (invalid) and defeat the purpose of enforcing LF. Re-save/commit this file with LF endings; also consider explicitly enforcing LF for .gitattributes itself.

*.sh text eol=lf
.github/workflows/*.yml text eol=lf
.github/workflows/*.yaml text eol=lf

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

.github/workflows/ci-main-pull-request-stub.yml:171

• This step downloads cyclonedx-cli from the releases/latest URL without pinning a version or verifying a checksum/signature. That makes the build non-reproducible and increases supply-chain risk (a future upstream release could break the workflow). Consider pinning to a specific CycloneDX CLI version and validating its SHA256 before executing it.

        run: |
          curl -sSL https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64 \
            -o /usr/local/bin/cyclonedx-cli
          chmod +x /usr/local/bin/cyclonedx-cli

.gitattributes:7

• This new .gitattributes file itself appears to be committed with CRLF line endings (visible as \r when viewed). That undermines the goal of enforcing LF and can cause noisy diffs on future edits. Re-save/normalize this file with LF endings before merging.

# Ensure shell scripts and GitHub Actions workflow files always use LF line
# endings, even when checked out/edited on Windows. Scripts with CRLF fail at
# runtime on Linux CI runners with errors like:
#   line 1: $'\r': command not found
*.sh text eol=lf
.github/workflows/*.yml text eol=lf
.github/workflows/*.yaml text eol=lf