Add SBOM delta generation for container builds (#219)

lucaronca · web-flow · commit ef4b09ee3fbb · 2026-05-05T12:29:36.000+02:00
* Handle sbom deltas

* fixup! Handle sbom deltas

* Add sboms zip in docker-publish workflow
diff --git a/.github/actions/sbom-delta/action.yml b/.github/actions/sbom-delta/action.yml
@@ -0,0 +1,42 @@
+name: Generate SBOM Delta
+description: Install Syft, generate delta SBOM for a container, and upload the artifact.
+
+inputs:
+  container:
+    description: Container name to scan
+    required: true
+  version:
+    description: Image tag or version
+    required: true
+  registry:
+    description: Registry prefix (e.g. ghcr.io/org/)
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install syft
+      shell: bash
+      run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
+
+    - name: Install task
+      shell: bash
+      run: which task || curl -sSfL https://taskfile.dev/install.sh | sh -s -- -b /usr/local/bin
+
+    - name: Generate delta SBOM
+      shell: bash
+      env:
+        CONTAINER: ${{ inputs.container }}
+        VERSION: ${{ inputs.version }}
+        REGISTRY: ${{ inputs.registry }}
+      run: |
+        task -t Taskfile.dist.yml sbom:delta -- \
+          --version "$VERSION" \
+          --registry "$REGISTRY" \
+          "$CONTAINER"
+
+    - name: Upload delta SBOM artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: sbom-delta-${{ inputs.container }}
+        path: ./containers/${{ inputs.container }}/sbom-delta/
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
@@ -210,6 +210,13 @@ jobs:
             REGISTRY=${{ env.DEV_REGISTRY_PATH }}
             BASE_IMAGE_VERSION=${{ needs.setup.outputs.image_tag }}
 
+      - name: SBOM Delta
+        uses: ./.github/actions/sbom-delta
+        with:
+          container: ${{ matrix.container }}
+          version: ${{ needs.setup.outputs.image_tag }}
+          registry: ${{ env.DEV_REGISTRY_PATH }}
+
   build-downstream:
     needs: [ setup, build ]
     if: needs.setup.outputs.downstream_containers != '[]'
@@ -302,3 +309,10 @@ jobs:
           build-args: |
             REGISTRY=${{ env.DEV_REGISTRY_PATH }}
             BASE_IMAGE_VERSION=${{ needs.setup.outputs.image_tag }}
+
+      - name: SBOM Delta
+        uses: ./.github/actions/sbom-delta
+        with:
+          container: ${{ matrix.container }}
+          version: ${{ needs.setup.outputs.image_tag }}
+          registry: ${{ env.DEV_REGISTRY_PATH }}
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
@@ -261,6 +261,13 @@ jobs:
           provenance: false
           build-args: ${{ steps.config.outputs.build_args }}
 
+      - name: SBOM Delta
+        uses: ./.github/actions/sbom-delta
+        with:
+          container: ${{ matrix.container }}
+          version: ${{ needs.detect.outputs.version }}
+          registry: ${{ env.GHCR_DESTINATION_ORG }}
+
       - name: Update compose file references
         if: steps.config.outputs.update_compose == 'true'
         env:
@@ -364,6 +371,13 @@ jobs:
             BASE_IMAGE_VERSION=${{ needs.detect.outputs.version }}
             REGISTRY=${{ env.GHCR_DESTINATION_ORG }}/
 
+      - name: SBOM Delta
+        uses: ./.github/actions/sbom-delta
+        with:
+          container: ${{ matrix.container }}
+          version: ${{ needs.detect.outputs.version }}
+          registry: ${{ env.GHCR_DESTINATION_ORG }}
+
       - name: Update compose file references
         if: steps.config.outputs.update_compose == 'true'
         env:
@@ -408,10 +422,21 @@ jobs:
           name: whl
           path: dist/
 
+      - name: Download all SBOM delta artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: sbom-delta-*
+          path: sbom-delta/
+
+      - name: Zip SBOM artifacts
+        run: zip -r dist/sboms.zip sbom-delta/
+
       - name: Upload release asset
         uses: softprops/action-gh-release@v2
         with:
-          files: dist/arduino*.whl
+          files: |
+            dist/arduino*.whl
+            dist/sboms.zip
           tag_name: ${{ needs.detect.outputs.tag_ref }}
           name: Release ${{ needs.detect.outputs.version }}
           prerelease: ${{ needs.detect.outputs.prerelease }}
diff --git a/Taskfile.dist.yml b/Taskfile.dist.yml
@@ -76,7 +76,7 @@ tasks:
     desc: Format code
     cmds:
       - ruff format
-  
+
   build-dev:
     desc: Build a development package
     cmds:
@@ -253,3 +253,8 @@ tasks:
           IMAGE: 'public.ecr.aws/arduino/app-bricks/ei-models-runner'
           TAG: '{{.EI_TAG}}'
           DIR: './containers/ei-models-runner'
+
+  sbom:delta:
+    desc: Generate delta SBOMs for containers (requires syft and registry access)
+    cmds:
+      - python3 ./scripts/sbom_delta.py {{.CLI_ARGS}}
diff --git a/containers/aihub-models-runner/ci.json b/containers/aihub-models-runner/ci.json
@@ -5,5 +5,8 @@
   "build_whl": false,
   "update_compose": false,
   "build_args": {},
+  "sbom": {
+    "runtime_base": "ubuntu:24.04"
+  },
   "downstream": ["gesture-recognition-runner"]
 }
diff --git a/containers/ei-models-runner/ci.json b/containers/ei-models-runner/ci.json
@@ -4,5 +4,8 @@
   "tag_latest": false,
   "build_whl": false,
   "update_compose": true,
-  "build_args": {}
+  "build_args": {},
+  "sbom": {
+    "runtime_base": "public.ecr.aws/g7a8t7v6/inference-container:v1.92.3"
+  }
 }
diff --git a/containers/ei-qnn-models-runner/ci.json b/containers/ei-qnn-models-runner/ci.json
@@ -4,5 +4,8 @@
   "tag_latest": false,
   "build_whl": false,
   "update_compose": true,
-  "build_args": {}
+  "build_args": {},
+  "sbom": {
+    "runtime_base": "public.ecr.aws/z9b3d4t5/inference-container-qnn:v1.92.19-test-f19ce2e7"
+  }
 }
diff --git a/containers/gesture-recognition-runner/ci.json b/containers/gesture-recognition-runner/ci.json
@@ -5,5 +5,8 @@
   "build_whl": false,
   "update_compose": true,
   "build_args": {},
+  "sbom": {
+    "runtime_base": "${REGISTRY}app-bricks/aihub-models-runner:${BASE_IMAGE_VERSION}"
+  },
   "downstream": []
 }
diff --git a/containers/python-apps-base/ci.json b/containers/python-apps-base/ci.json
@@ -9,5 +9,8 @@
   "tag_latest": false,
   "build_whl": true,
   "update_compose": false,
-  "build_args": { }
+  "build_args": { },
+  "sbom": {
+    "runtime_base": "${REGISTRY}app-bricks/python-base:${BASE_IMAGE_VERSION}"
+  }
 }
diff --git a/containers/python-base/Dockerfile b/containers/python-base/Dockerfile
@@ -22,7 +22,8 @@ RUN set -ex; \
     echo "https://github.com/${OPENCV_REPO_OWNER}/app-bricks-py/releases/download/opencv/${OPENCV_VERSION}/opencv_python_headless-${OPENCV_VERSION}-${PYTHON_VERSION}-${PYTHON_VERSION}-linux_aarch64.whl" >> /app/requirements.txt; \
     # Install Python dependencies
     pip install --no-cache-dir uv; \
-    uv pip install --system --no-cache-dir -r /app/requirements.txt && rm /app/requirements.txt; \
+    uv pip install --system --no-cache-dir -r /app/requirements.txt; \
+    rm /app/requirements.txt; \
     # Strip debug symbols, tests and remove unneeded packages to reduce size
     find /usr/local/lib/python3.13/site-packages -type f -name "*.so" -exec strip -s {} +; \
     find /usr/local/lib/python3.13/site-packages -type f -name "*.so.*" -exec strip -s {} +; \
@@ -74,12 +75,13 @@ RUN set -ex; \
     rm -rf /var/lib/apt/lists/*; \
     rm -fr /var/cache/apt/archives/*.deb \
         /var/cache/apt/archives/partial/*.deb \
-        /usr/share/doc/* \
         /usr/share/man/* \
         /usr/share/locale/* \
         /var/cache/debconf/* \
-        /var/lib/dpkg/info/* \      
+        /var/lib/dpkg/info/* \
         /var/cache/apt/*.bin; \
+    find /usr/share/doc -type f ! -name 'copyright' -delete; \
+    find /usr/share/doc -type d -empty -delete; \
     # precompile python files to .pyc to speed up startup time
     python -m compileall /usr/local/bin; \
     python -m compileall /usr/local/lib
diff --git a/containers/python-base/ci.json b/containers/python-base/ci.json
@@ -5,5 +5,8 @@
   "build_whl": false,
   "update_compose": false,
   "build_args": {},
+  "sbom": {
+    "runtime_base": "python:3.13-slim"
+  },
   "downstream": ["python-apps-base"]
 }
diff --git a/scripts/__init__.py b/scripts/__init__.py
@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: Copyright (C) ARDUINO SRL (http://www.arduino.cc)
+#
+# SPDX-License-Identifier: MPL-2.0
diff --git a/scripts/sbom_delta.py b/scripts/sbom_delta.py

Original file line number	Diff line number	Diff line change
`@@ -5,5 +5,8 @@`
`5`	`5`	`"build_whl": false,`
`6`	`6`	`"update_compose": false,`
`7`	`7`	`"build_args": {},`
	`8`	`+ "sbom": {`
	`9`	`+ "runtime_base": "ubuntu:24.04"`
	`10`	`+ },`
`8`	`11`	`"downstream": ["gesture-recognition-runner"]`
`9`	`12`	`}`
Original file line number	Diff line number	Diff line change
`@@ -5,5 +5,8 @@`
`5`	`5`	`"build_whl": false,`
`6`	`6`	`"update_compose": true,`
`7`	`7`	`"build_args": {},`
	`8`	`+ "sbom": {`
	`9`	`+ "runtime_base": "${REGISTRY}app-bricks/aihub-models-runner:${BASE_IMAGE_VERSION}"`
	`10`	`+ },`
`8`	`11`	`"downstream": []`
`9`	`12`	`}`