Add workflow code to generate SBOMs and upload them to the release/pre-release by jsf9k · Pull Request #179 · cisagov/skeleton-python-library

jsf9k · 2026-01-20T20:33:58Z

🗣 Description

This pull request:

Adds workflow code to generate SBOMs for the Python distribution package
If we happen to be building a release or pre-release then the SBOMs will be uploaded to the release or pre-release.
Adds workflow code to create provenance attestations for the SBOMs and the Python distribution package
Adds workflow code to create SBOM attestations for the Python distribution package

💭 Motivation and context

CISA advocates for the use of SBOMs, so we should be generating them for our software products.

Resolves #178.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All new and existing tests pass.

✅ Pre-merge checklist

Mark SBOM checks as required.

setup.py no longer exists, but pyproject.toml has taken its place.

…ions

Thus our SBOMs are named, e.g., cisagov-skeleton-python-library.py3.13.spdx-json rather than sbom.py3.13.spdx-json.

The latest release supports the artifact-metadata permission that we are now using in the generate-sbom job of the build.yml GitHub Actions workflow.

Note that actions/attest-build-provenance has changed its name to actions/attest, partly because it now supports different types of attestations. One such type is an SBOM attestation, which we are now using here.

dav3r

👍 👍

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

This agrees with changes made elsewhere in this workflow.

This job name changed in a previous commit and hence needs to be updated here as well.

wheel need not be installed alongside setuptools as of setuptools 70.1.

felddy

Looks good. Nice and clean.

Not today, but in the future, we should consider decoupling the attestation steps from the build process. i.e., move attestation to its own workflow. This will be helpful when we move to reusable workflows, and have various artifacts to attest. (SBOMs, vulnerability scans, provenance, etc..)

Strong work! 💪

mcdonnnj

I spoke with @jsf9k in person about this but I have some reservations about SBOMs for our Python projects. The issue is that the only way to generate one at present is to create a lockfile of some kind (this PR uses Pipfile.lock) and generate an SBOM from this snapshot of dependencies. Unlike our Docker images there is no guarantee that the same software with the same versions will be installed when installing the project/wheel at a later point in time.

mcdonnnj · 2026-04-24T14:53:47Z

      - name: Setup tmate debug session
        uses: mxschmitt/action-tmate@v3
        if: env.RUN_TMATE
+  generate-sbom:


I think a release workflow still makes sense here. We should be uploading a wheel to releases and it does not need to be built with different Python versions. I think a release workflow that builds a wheel for the release and then uploads the built wheel and SBOMs generated from that wheel makes more sense than band-aiding it to this workflow.

mcdonnnj · 2026-04-24T16:56:21Z

+          artifact-name: >-
+            ${{ steps.manipulate-repo-name.outputs.repo-name }}.py${{
+            matrix.python-version }}.${{ matrix.sbom-format }}
+          file: Pipfile.lock


An issue here is the SBOM may not accurately reflect the result of installing the Python package. The Pipfile.lock file is a snapshot in time of the dependency chain, but there is no guarantee of the same result if you install the wheel at a later point.

jsf9k · 2026-04-27T14:24:20Z

@mcdonnnj mentioned PEP 770, which is related. See also here and pypa/setuptools#4821).

jsf9k self-assigned this Jan 20, 2026

jsf9k added this to Next Kraken and Skeleton Maintenance Jan 20, 2026

github-project-automation Bot moved this to In progress in Skeleton Maintenance Jan 20, 2026

jsf9k moved this to In Progress in Next Kraken Jan 20, 2026

github-actions Bot added the github-actions Pull requests that update GitHub Actions code label Jan 20, 2026

jsf9k force-pushed the feature/add-sbom branch 6 times, most recently from 85920f3 to 6a499a3 Compare January 20, 2026 21:50

jsf9k added 2 commits January 20, 2026 17:03

Use pyproject.toml instead of setup.py when generating cache keys

8483eb6

setup.py no longer exists, but pyproject.toml has taken its place.

Add code to generate SBOMs and attach them to the release as assets

e5806d4

jsf9k force-pushed the feature/add-sbom branch from 6a499a3 to e5806d4 Compare January 20, 2026 22:03

jsf9k added 2 commits January 21, 2026 00:02

Add (commented out) Dependabot ignore directives for SBOM-related act…

f34b78e

…ions

Manipulate the repo name and use that in the SBOM file name

281d5aa

Thus our SBOMs are named, e.g., cisagov-skeleton-python-library.py3.13.spdx-json rather than sbom.py3.13.spdx-json.

jsf9k force-pushed the feature/add-sbom branch from 216405b to 281d5aa Compare January 26, 2026 15:18

Upgrade to the latest release of the check-jsonschema pre-commit hook

11e73ea

The latest release supports the artifact-metadata permission that we are now using in the generate-sbom job of the build.yml GitHub Actions workflow.

github-actions Bot added dependencies Pull requests that update a dependency file version bump This issue or pull request increments the version number python Pull requests that update Python code labels Jan 26, 2026

jsf9k force-pushed the feature/add-sbom branch from ef9a6a8 to 11e73ea Compare January 26, 2026 18:47

jsf9k removed version bump This issue or pull request increments the version number python Pull requests that update Python code labels Jan 26, 2026

jsf9k marked this pull request as ready for review January 26, 2026 19:05

jsf9k requested review from dav3r, felddy and mcdonnnj as code owners January 26, 2026 19:05

jsf9k moved this from In progress to Review in progress in Skeleton Maintenance Jan 26, 2026

jsf9k added 3 commits February 23, 2026 11:11

Upgrade actions/cache to match version used in parent skeleton

6e666cf

Clean up definitions of cache keys to match upstream

3d03aef

Word wrap some comment text

2b0e646

jsf9k force-pushed the feature/add-sbom branch from 407cce7 to 58b63d0 Compare March 9, 2026 17:00

Upgrade to the latest name and version for the attestation action

3ef4839

Note that actions/attest-build-provenance has changed its name to actions/attest, partly because it now supports different types of attestations. One such type is an SBOM attestation, which we are now using here.

jsf9k force-pushed the feature/add-sbom branch from 58b63d0 to 3ef4839 Compare March 9, 2026 17:20

Add provenance attestation for the SBOM

03bd84e

jsf9k requested a review from dav3r March 10, 2026 17:02

jsf9k force-pushed the feature/add-sbom branch from 83337e8 to 03bd84e Compare March 10, 2026 17:14

dav3r approved these changes Mar 10, 2026

View reviewed changes

Add provenance attestation for distribution

26e7ea5

jsf9k force-pushed the feature/add-sbom branch from 502f151 to 26e7ea5 Compare March 10, 2026 17:36

dav3r approved these changes Mar 10, 2026

View reviewed changes

jsf9k requested a review from Copilot March 10, 2026 18:58

Copilot started reviewing on behalf of jsf9k March 10, 2026 18:59 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Comment thread .github/workflows/build.yml Outdated

Comment thread .github/workflows/build.yml

Pare down permissions

000c695

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

dav3r approved these changes Mar 10, 2026

View reviewed changes

jsf9k added 6 commits April 13, 2026 14:02

Merge remote-tracking branch 'origin/develop' into feature/add-sbom

5411050

Upgrade instance of actions/download-artifact to v8

10267a1

This agrees with changes made elsewhere in this workflow.

Merge remote-tracking branch 'origin/develop' into feature/add-sbom

ff1220f

Update job name in SBOM portion of workflow

e731855

This job name changed in a previous commit and hence needs to be updated here as well.

Remove manual installation of wheel

fa900f6

wheel need not be installed alongside setuptools as of setuptools 70.1.

Merge remote-tracking branch 'origin/develop' into feature/add-sbom

cb7fb8b

jsf9k requested a review from rm-sbin-sh April 14, 2026 15:19

rm-sbin-sh approved these changes Apr 15, 2026

View reviewed changes

github-project-automation Bot moved this from Review in progress to Reviewer approved in Skeleton Maintenance Apr 15, 2026

felddy approved these changes Apr 17, 2026

View reviewed changes

mcdonnnj reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add workflow code to generate SBOMs and upload them to the release/pre-release#179

Add workflow code to generate SBOMs and upload them to the release/pre-release#179
jsf9k wants to merge 21 commits intodevelopfrom
feature/add-sbom

jsf9k commented Jan 20, 2026 •

edited

Loading

Uh oh!

dav3r left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

felddy left a comment

Uh oh!

mcdonnnj left a comment

Uh oh!

mcdonnnj Apr 24, 2026

Uh oh!

mcdonnnj Apr 24, 2026

Uh oh!

jsf9k commented Apr 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

jsf9k commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

✅ Pre-merge checklist

Uh oh!

dav3r left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

felddy left a comment

Choose a reason for hiding this comment

Uh oh!

mcdonnnj left a comment

Choose a reason for hiding this comment

Uh oh!

mcdonnnj Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

mcdonnnj Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

jsf9k commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

jsf9k commented Jan 20, 2026 •

edited

Loading

jsf9k commented Apr 27, 2026 •

edited

Loading