Skip to content

feat: sbom generation ubuntu and nix packages #1973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
samrose wants to merge 10 commits into
base: develop
Choose a base branch
from
+2,968 −67
Open

feat: sbom generation ubuntu and nix packages #1973

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6e1342a
feat: sbom generation ubuntu and nix packages
samrose Dec 9, 2025
6367ec0
fix: https://cwe.mitre.org/data/definitions/23.html issue
samrose Dec 9, 2025
87fb5c5
fix: update nixpkgs version for sbomnix
samrose Dec 17, 2025
7d1d1d2
fix: flake lock
samrose Dec 18, 2025
5bd4d2f
feat: cleanup and tests
samrose Jan 13, 2026
2e97fa8
fix: restore package
samrose Jan 13, 2026
d035a38
feat: read manifest for paths and create/upload sbom
samrose Jan 15, 2026
a881715
fix: Added the security assumption comment to Generate() and a refere…
samrose Jan 15, 2026
842b630
fix: remove sbom create at this point
samrose Jan 15, 2026
dfa1fd5
chore: clean up and rm old stage 1 sbom creation
samrose Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions .github/workflows/ami-release-nix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,36 @@ jobs:

echo "Catalog uploaded to ${CATALOG_S3}"

- name: Assume SBOM artifacts role
uses: aws-actions/configure-aws-credentials@v4.1.0
with:
aws-region: ap-southeast-1
role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
role-session-name: shared-services-jump

- name: Upload comprehensive SBOM to shared artifacts
uses: aws-actions/configure-aws-credentials@v4.1.0
with:
aws-region: ap-southeast-1
role-to-assume: arn:aws:iam::279559813984:role/supabase-sbom-artifacts-role
role-skip-session-tagging: true
role-session-name: upload-sbom
role-chaining: true

- name: Upload SBOM
run: |
VERSION="${{ steps.process_release_version.outputs.version }}"

# Check if comprehensive SBOM exists (generated during AMI build)
if [ -f "nix-sbom.spdx.json" ]; then
aws s3 cp nix-sbom.spdx.json \
"s3://${{ secrets.SHARED_AWS_ARTIFACTS_BUCKET }}/sbom/${VERSION}/sbom.spdx.json" \
--content-type "application/json"
echo "::notice title=SBOM Uploaded::Comprehensive SBOM for ${VERSION} uploaded to shared artifacts"
else
echo "::warning title=SBOM Missing::Comprehensive SBOM file not found, skipping upload"
fi
Comment on lines +203 to +215
Copy link

@coderabbitai coderabbitai bot Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's find the relevant files mentioned in the review
find . -name "stage2-nix-psql.pkr.hcl" -o -name "action.yml" -o -name "nix-provision.sh" | head -20

Repository: supabase/postgres

Length of output: 301

🏁 Script executed:

# Check the current workflow file to understand the context around lines 203-215
cat -n .github/workflows/ami-release-nix.yml | sed -n '70,220p'

Repository: supabase/postgres

Length of output: 7876

🏁 Script executed:

# Search for any SBOM-related patterns in the repository
rg -i "nix-sbom\|sbom.*spdx" --type yaml --type sh --type hcl -B 2 -A 2

Repository: supabase/postgres

Length of output: 88

🏁 Script executed:

# Check the build-ami action for SBOM handling
cat .github/actions/build-ami/action.yml

Repository: supabase/postgres

Length of output: 3139

🏁 Script executed:

# Check the Packer config for SBOM download provisioner
cat stage2-nix-psql.pkr.hcl

Repository: supabase/postgres

Length of output: 2515

🏁 Script executed:

# Check nix-provision.sh for SBOM generation
cat scripts/nix-provision.sh

Repository: supabase/postgres

Length of output: 2615

🏁 Script executed:

# Search for any SBOM-related patterns more broadly
rg -i "nix-sbom\|sbom.*spdx" -B 2 -A 2

Repository: supabase/postgres

Length of output: 43

🏁 Script executed:

# Search for SBOM generation in Ansible playbooks
rg -i "sbom" ansible/

Repository: supabase/postgres

Length of output: 43

🏁 Script executed:

# Check the main playbook that's being run
cat ansible/playbook.yml

Repository: supabase/postgres

Length of output: 6889

🏁 Script executed:

# Look for any step that copies files FROM the EC2 instance back to the workspace
rg -i "copy.*from\|scp\|s3.*cp\|artifacts" stage2-nix-psql.pkr.hcl scripts/

Repository: supabase/postgres

Length of output: 43

🏁 Script executed:

# Search for nix-sbom generation in the entire repository
rg -i "nix-sbom\|generate.*sbom\|sbom.*generate" -g "!.git"

Repository: supabase/postgres

Length of output: 43

🏁 Script executed:

# Check if there's SBOM generation in the Nix flake or related files
find . -name "flake.nix" -o -name "flake.lock" | head -10

Repository: supabase/postgres

Length of output: 85

🏁 Script executed:

# Look for any Nix files that might generate SBOM
fd -t f "\.nix$" | head -20

Repository: supabase/postgres

Length of output: 523

🏁 Script executed:

# Check the build-ami Nix command to see what it does
rg "build-ami" -g "*.nix" -B 3 -A 3

Repository: supabase/postgres

Length of output: 872

🏁 Script executed:

# Search for any SBOM or CycloneDX or SPDX mentions anywhere in the repo
rg -i "cyclone|spdx" --type-list

Repository: supabase/postgres

Length of output: 450

🏁 Script executed:

# Search without type restriction
rg -i "cyclone|spdx"

Repository: supabase/postgres

Length of output: 23564

🏁 Script executed:

# Now let's check the build-ami.nix to see if it generates the SBOM file
cat nix/packages/build-ami.nix

Repository: supabase/postgres

Length of output: 5465

🏁 Script executed:

# Also check if there's a Nix flake app or package that calls the SBOM generation
grep -r "nix-sbom" --include="*.nix" --include="*.sh" --include="*.yml"

Repository: supabase/postgres

Length of output: 226

🏁 Script executed:

# Final verification: check if there's any step between build-ami and SBOM upload that generates the file
cat -n .github/workflows/ami-release-nix.yml | sed -n '75,216p'

Repository: supabase/postgres

Length of output: 7502

The SBOM file (nix-sbom.spdx.json) is not currently generated or made available in the workflow.

Between the Build AMI step and the Upload SBOM step, there is no mechanism to generate or download the SBOM file. The build-ami action runs Packer provisioning through stage2-nix-psql.pkr.hcl and nix-provision.sh, which invokes an Ansible playbook, but none of these steps produce nix-sbom.spdx.json in the workflow runner's working directory. There is no step to copy the file from the EC2 instance back to the workflow.

A SBOM generator tool exists in the repository at nix/packages/sbom/, but it is not integrated into the build pipeline. The conditional check at line 208 will always fail, and the upload will always be skipped with a warning.

Integrate SBOM generation into the build pipeline (either by adding a provisioner step in the Packer config or by calling the sbom tool after the AMI build), or if SBOM is not required, remove the incomplete upload step entirely. If SBOM is critical for compliance, fail the workflow when the file is missing rather than just warning.

🤖 Prompt for AI Agents 
In @.github/workflows/ami-release-nix.yml around lines 203 - 215, The Upload
SBOM step is checking for nix-sbom.spdx.json but nothing produces or retrieves
that file from the Build AMI/Packer run; to fix, either (A) generate the SBOM on
the runner before the Upload SBOM step by invoking the repository SBOM tool
(nix/packages/sbom/) to create nix-sbom.spdx.json (use the same VERSION variable
and output path) so the existing aws s3 cp succeeds, or (B) change the AMI build
(stage2-nix-psql.pkr.hcl / nix-provision.sh) to produce and copy the SBOM off
the builder (e.g., add a Packer post-processor or an SSH/ansible step that scps
the SBOM back to the runner) and ensure that file is placed as
nix-sbom.spdx.json, and if SBOM is required make the Upload SBOM step fail the
job when the file is missing instead of only warning; update the Upload SBOM
step logic accordingly to match the chosen approach.


- name: Create release
uses: softprops/action-gh-release@v2
with:
Expand Down
5 changes: 5 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,3 +33,8 @@ common-nix.vars.pkr.hcl
nixos.qcow2
.lsp
.clj-kondo
#sbom development files
http_cache.sqlite
nix-sbom.spdx.json
sbom.cdx.json
sbom.csv
Loading
Loading