workflows: debos: Generate SBOM of rootfs with syft

Signed-off-by: Loïc Minier <[email protected]>

Author: lool

.github/workflows/debos.yml

@@ -25,6 +25,9 @@ defaults:
 
 env:
   FILESERVER_URL: https://quic-yocto-fileserver-1029608027416.us-central1.run.app
+  # github runs are only unique per repository and may also be re-run; create a
+  # build id for the current run
+  BUILD_ID: ${{ github.repository }}-${{ github.run_id }}-${{ github.run_attempt }}
 
 # cancel in progress builds for this workflow triggered by the same ref
 concurrency:
@@ -33,6 +36,7 @@ concurrency:
 
 jobs:
   build-debos:
+    name: Build and upload debos recipes
     runs-on: [self-hosted, arm64, debbuilder]
     container:
       image: debian:trixie
@@ -90,17 +94,14 @@ jobs:
           # build flashable files
           debos -t u_boot_rb1:rb1-boot.img qualcomm-linux-debian-flash.yaml
 
-      - name: Upload artifacts to fileserver
+      - name: Upload artifacts to fileserver space for builds
         run: |
           set -x
           # curl will be used to talk to fileserver; should be installed by
           # default
           apt -y install curl
-          # github runs are only unique per repository and may also be re-run;
-          # create an unique id with repository, run id, and run attempt
-          id="${GITHUB_REPOSITORY}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           # create a directory for the current run
-          dir="/fileserver-builds/${id}"
+          dir="/fileserver-builds/${BUILD_ID}"
           mkdir -vp "${dir}"
           # copy output files
           cp -av rootfs.tar.gz "${dir}"
@@ -117,6 +118,67 @@ jobs:
               disk-sdcard.img2 \
               flash_rb1*
           # instruct fileserver to publish this directory
-          url="${FILESERVER_URL}/${id}/"
+          url="${FILESERVER_URL}/${BUILD_ID}/"
+          curl -X POST -H 'Accept: text/event-stream' "${url}"
+
+      - name: Upload artifacts to fileserver space for downloads
+        run: |
+          set -ux
+          # create a directory for the current run
+          dir="/fileserver-downloads/${BUILD_ID}"
+          mkdir -vp "${dir}"
+          # copy output files
+          cp -av rootfs.tar.gz "${dir}"
+
+  syft:
+    name: Run syft on rootfs
+    # nowadays also available on arm64; set x86 for predictability
+    runs-on: [self-hosted, x86]
+    needs: build-debos
+    container:
+      # this is the upstream maintained image, not sure what criteria it has to
+      # pass to be considered trusted; also, we assume it's Debian/Ubuntu-based
+      # and that misc tool such as apt/tar/nproc/curl will be available
+      image: anchore/syft
+      volumes:
+        - /srv/gh-runners/quic-yocto/builds:/fileserver-builds
+        - /srv/gh-runners/quic-yocto/downloads:/fileserver-downloads
+    steps:
+      - name: Get rootfs, generate SBOM with syft and upload to fileserver
+        run: |
+          set -ux
+          # curl will be used to talk to fileserver; should be installed by
+          # default
+          apt -y install curl
+          # retrieve and unpack rootfs
+          cp -av /fileserver-downloads/${BUILD_ID}/rootfs.tar.gz .
+          mkdir rootfs
+          tar -C rootfs -xvf rootfs.tar.gz
+          # run syft
+          # TODO should probably restrict catalogers a bit as the rootfs is
+          # built entirely from deb packages
+          # TODO should set source-version
+          syft --version
+          SYFT_FORMAT_JSON_PRETTY=true syft -v \
+              -o cyclonedx-json=rootfs-sbom.cyclonedx.json \
+              -o spdx-json=rootfs-sbom.spdx.json \
+              -o syft-json=rootfs-sbom.syft.json \
+              -o syft-text=rootfs-sbom.syft.txt \
+              -o syft-table \
+              --parallelism `nproc` \
+              --source-name qualcomm-linux-debian-rootfs \
+              --source-version "${BUILD_ID}" \
+              -v \
+              scan rootfs
+          # compress
+          gzip rootfs-sbom*
+          # copy to fileserver
+          for dir in
+              "/fileserver-builds/${BUILD_ID}"
+              "/fileserver-downloads/${BUILD_ID}"; do
+              cp -av rootfs-sbom*.gz "${dir}"
+          done
+          # instruct fileserver to publish this directory
+          url="${FILESERVER_URL}/${BUILD_ID}/"
           curl -X POST -H 'Accept: text/event-stream' "${url}"