Add SPDX SBOM generation to build-and-publish workflow

doc/changes/unreleased.md

@@ -1,3 +1,4 @@
 # Unreleased
 
 ## Summary
+* Added SPDX SBOM generation to the build-and-publish workflow using `cyclonedx-py` and `sbomconvert`

doc/user_guide/features/github_workflows/index.rst

@@ -65,6 +65,10 @@ Maintained by the PTB
    * - ``build-and-publish.yml``
      - Workflow call
      - Packages the distribution and publishes it to PyPi and GitHub.
+       Also generates an SPDX SBOM (Software Bill of Materials) using
+       ``cyclonedx-py`` and ``sbomconvert`` and attaches it to the GitHub release.
+       Note: SPDX version 2 is used as no stable Python tool exists yet
+       for generating SPDX version 3.
    * - ``cd.yml``
      - Push with new tag
      - Manages continuous delivery by creating and uploading build artifacts and

exasol/toolbox/nox/_dependencies.py

@@ -100,3 +100,32 @@ def report_resolved_vulnerabilities(session: Session) -> None:
         current_vulnerabilities=get_vulnerabilities(path),
     )
     print(audit.report_resolved_vulnerabilities())
+
+
+@nox.session(name="dependency:sbom", python=False)
+def generate_sbom(session: Session) -> None:
+    """Generate SPDX SBOM for the project dependencies."""
+    session.run(
+        "poetry",
+        "run",
+        "cyclonedx-py",
+        "environment",
+        "-o",
+        "bom.cdx.json",
+        external=True,
+    )
+    session.run(
+        "poetry",
+        "run",
+        "sbomconvert",
+        "-i",
+        "bom.cdx.json",
+        "--sbom",
+        "spdx",
+        "--format",
+        "json",
+        "-o",
+        "bom.spdx.json",
+        external=True,
+    )
+    session.run("test", "-s", "bom.spdx.json", external=True)

exasol/toolbox/templates/github/workflows/build-and-publish.yml

@@ -31,6 +31,13 @@ jobs:
         id: build-artifacts
         run: poetry build
 
+      - name: Generate SBOM
+        id: generate-sbom
+        run: |
+          poetry run cyclonedx-py environment -o bom.cdx.json
+          poetry run sbomconvert -i bom.cdx.json --sbom spdx --format json -o bom.spdx.json
+          test -s bom.spdx.json
+
       - name: Publish Release to PyPi
         id: publish-release-to-pypi
         env:
@@ -47,3 +54,4 @@ jobs:
           --title ${GITHUB_REF_NAME}
           --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md
           dist/*
+          bom.spdx.json