Integrate Native Image SBOM with GitHub's Dependency Submission API

.github/workflows/test.yml

@@ -420,3 +420,40 @@ jobs:
       #     popd > /dev/null
       - name: Remove components
         run: gu remove espresso llvm-toolchain nodejs python ruby wasm
+  test-sbom:
+    name: test 'native-image-enable-sbom' option
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
+    strategy:
+      matrix:
+        java-version: ['24-ea', 'latest-ea']
+        distribution: ['graalvm']
+        os: [macos-latest, windows-latest, ubuntu-latest]
+        set-gds-token: [false]
+        components: ['']
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run setup-graalvm action
+        uses: ./
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: ${{ matrix.distribution }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          components: ${{ matrix.components }}
+          gds-token: ${{ matrix.set-gds-token && secrets.GDS_TOKEN || '' }}
+          native-image-enable-sbom: 'true'
+      - name: Build Maven project and verify that SBOM was generated and its contents
+        run: |
+          cd __tests__/sbom/main-test-app
+          mvn --no-transfer-progress -Pnative package
+          bash verify-sbom.sh
+        shell: bash
+        if: runner.os != 'Windows'
+      - name: Build Maven project and verify that SBOM was generated and its contents (Windows)
+        run: |
+          cd __tests__\sbom\main-test-app
+          mvn --no-transfer-progress -Pnative package
+          cmd /c verify-sbom.cmd
+        shell: cmd
+        if: runner.os == 'Windows'

.gitignore

@@ -96,4 +96,7 @@ Thumbs.db
 
 # Ignore built ts files
 __tests__/runner/*
-lib/**/*
+lib/**/*
+
+# Ignore target directory in __tests__
+__tests__/**/target

README.md

@@ -205,6 +205,7 @@ This actions can be configured with the following options:
 | `native-image-job-reports` *) | `'false'` | If set to `'true'`, post a job summary containing a Native Image build report. |
 | `native-image-pr-reports`  *) | `'false'` | If set to `'true'`, post a comment containing a Native Image build report on pull requests. Requires `write` permissions for the [`pull-requests` scope][gha-permissions]. |
 | `native-image-pr-reports-update-existing` *) | `'false'` | Instead of posting another comment, update an existing PR comment with the latest Native Image build report. Requires `native-image-pr-reports` to be `true`. |
+| `native-image-enable-sbom` | `'false'` | If set to `'true'`, generate a minimal SBOM based on the Native Image static analysis and submit it to GitHub's dependency submission API. This enables the [dependency graph feature](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) for dependency tracking and vulnerability analysis. Requires `write` permissions for the [`contents` scope][gha-permissions] and the dependency graph to be actived (on by default for public repositories - see [how to activate](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-graph#enabling-and-disabling-the-dependency-graph-for-a-private-repository)). Only available in Oracle GraalVM for JDK 24 or later. |
 | `components`    | `''`     | Comma-separated list of GraalVM components (e.g., `native-image` or `ruby,nodejs`) that will be installed by the [GraalVM Updater][gu]. |
 | `version` | `''` | `X.Y.Z` (e.g., `22.3.0`) for a specific [GraalVM release][releases] up to `22.3.2`<br>`mandrel-X.Y.Z.W` or `X.Y.Z.W-Final` (e.g., `mandrel-21.3.0.0-Final` or `21.3.0.0-Final`) for a specific [Mandrel release][mandrel-releases],<br>`mandrel-latest` or `latest` for the latest Mandrel stable release. |
 | `gds-token`     | `''`     Download token for the GraalVM Download Service. If a non-empty token is provided, the action will set up Oracle GraalVM (see [Oracle GraalVM via GDS template](#template-for-oracle-graalvm-via-graalvm-download-service)) or GraalVM Enterprise Edition (see [GraalVM EE template](#template-for-graalvm-enterprise-edition)) via GDS. |

__tests__/cleanup.test.ts

@@ -49,7 +49,7 @@ describe('cleanup', () => {
     resetState()
   })
 
-  it('does not fail nor warn even when the save provess throws a ReserveCacheError', async () => {
+  it('does not fail nor warn even when the save process throws a ReserveCacheError', async () => {
     spyCacheSave.mockImplementation((paths: string[], key: string) =>
       Promise.reject(
         new cache.ReserveCacheError(

__tests__/sbom.test.ts

@@ -0,0 +1,306 @@
+import * as c from '../src/constants'
+import {setUpSBOMSupport, processSBOM} from '../src/features/sbom'
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as glob from '@actions/glob'
+import {join} from 'path'
+import {tmpdir} from 'os'
+import {mkdtempSync, writeFileSync, rmSync} from 'fs'
+
+jest.mock('@actions/glob')
+jest.mock('@actions/github', () => ({
+  getOctokit: jest.fn(() => ({
+    request: jest.fn().mockResolvedValue(undefined)
+  })),
+  context: {
+    repo: {
+      owner: 'test-owner',
+      repo: 'test-repo'
+    },
+    sha: 'test-sha',
+    ref: 'test-ref',
+    workflow: 'test-workflow',
+    job: 'test-job',
+    runId: '12345'
+  }
+}))
+
+function mockFindSBOM(files: string[]) {
+  const mockCreate = jest.fn().mockResolvedValue({
+    glob: jest.fn().mockResolvedValue(files)
+  })
+  ;(glob.create as jest.Mock).mockImplementation(mockCreate)
+}
+
+// Mocks the GitHub dependency submission API return value
+// 'undefined' is treated as a successful request
+function mockGithubAPIReturnValue(returnValue: Error | undefined = undefined) {
+  const mockOctokit = {
+    request:
+      returnValue === undefined
+        ? jest.fn().mockResolvedValue(returnValue)
+        : jest.fn().mockRejectedValue(returnValue)
+  }
+  ;(github.getOctokit as jest.Mock).mockReturnValue(mockOctokit)
+  return mockOctokit
+}
+
+describe('sbom feature', () => {
+  let spyInfo: jest.SpyInstance<void, Parameters<typeof core.info>>
+  let spyWarning: jest.SpyInstance<void, Parameters<typeof core.warning>>
+  let spyExportVariable: jest.SpyInstance<
+    void,
+    Parameters<typeof core.exportVariable>
+  >
+  let workspace: string
+  let originalEnv: NodeJS.ProcessEnv
+  const javaVersion = '24.0.0'
+  const distribution = c.DISTRIBUTION_GRAALVM
+
+  beforeEach(() => {
+    originalEnv = process.env
+
+    process.env = {
+      ...process.env,
+      GITHUB_REPOSITORY: 'test-owner/test-repo',
+      GITHUB_TOKEN: 'fake-token'
+    }
+
+    workspace = mkdtempSync(join(tmpdir(), 'setup-graalvm-sbom-'))
+    mockGithubAPIReturnValue()
+
+    spyInfo = jest.spyOn(core, 'info').mockImplementation(() => null)
+    spyWarning = jest.spyOn(core, 'warning').mockImplementation(() => null)
+    spyExportVariable = jest
+      .spyOn(core, 'exportVariable')
+      .mockImplementation(() => null)
+    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
+      if (name === 'native-image-enable-sbom') {
+        return 'true'
+      }
+      if (name === 'github-token') {
+        return 'fake-token'
+      }
+      return ''
+    })
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+    jest.clearAllMocks()
+    spyInfo.mockRestore()
+    spyWarning.mockRestore()
+    spyExportVariable.mockRestore()
+    rmSync(workspace, {recursive: true, force: true})
+  })
+
+  describe('setup', () => {
+    it('should throw an error when the distribution is not Oracle GraalVM', () => {
+      const not_supported_distributions = [
+        c.DISTRIBUTION_GRAALVM_COMMUNITY,
+        c.DISTRIBUTION_MANDREL,
+        c.DISTRIBUTION_LIBERICA,
+        ''
+      ]
+      for (const distribution of not_supported_distributions) {
+        expect(() => setUpSBOMSupport(javaVersion, distribution)).toThrow()
+      }
+    })
+
+    it('should throw an error when the java-version is not supported', () => {
+      const not_supported_versions = ['23', '23-ea', '21.0.3', 'dev', '17', '']
+      for (const version of not_supported_versions) {
+        expect(() => setUpSBOMSupport(version, distribution)).toThrow()
+      }
+    })
+
+    it('should not throw an error when the java-version is supported', () => {
+      const supported_versions = ['24', '24-ea', '24.0.2', 'latest-ea']
+      for (const version of supported_versions) {
+        expect(() => setUpSBOMSupport(version, distribution)).not.toThrow()
+      }
+    })
+
+    it('should set the SBOM option when activated', () => {
+      setUpSBOMSupport(javaVersion, distribution)
+
+      expect(spyExportVariable).toHaveBeenCalledWith(
+        c.NATIVE_IMAGE_OPTIONS_ENV,
+        expect.stringContaining('--enable-sbom=export')
+      )
+      expect(spyInfo).toHaveBeenCalledWith(
+        'Enabled SBOM generation for Native Image build'
+      )
+      expect(spyWarning).not.toHaveBeenCalled()
+    })
+
+    it('should not set the SBOM option when not activated', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false')
+      setUpSBOMSupport(javaVersion, distribution)
+
+      expect(spyExportVariable).not.toHaveBeenCalled()
+      expect(spyInfo).not.toHaveBeenCalled()
+      expect(spyWarning).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('process', () => {
+    async function setUpAndProcessSBOM(sbom: object): Promise<void> {
+      setUpSBOMSupport(javaVersion, distribution)
+      spyInfo.mockClear()
+
+      // Mock 'native-image' invocation by creating the SBOM file
+      const sbomPath = join(workspace, 'test.sbom.json')
+      writeFileSync(sbomPath, JSON.stringify(sbom, null, 2))
+
+      mockFindSBOM([sbomPath])
+
+      await processSBOM()
+    }
+
+    const sampleSBOM = {
+      bomFormat: 'CycloneDX',
+      specVersion: '1.5',
+      version: 1,
+      serialNumber: 'urn:uuid:52c977f8-6d04-3c07-8826-597a036d61a6',
+      components: [
+        {
+          type: 'library',
+          group: 'org.json',
+          name: 'json',
+          version: '20241224',
+          purl: 'pkg:maven/org.json/json@20241224',
+          'bom-ref': 'pkg:maven/org.json/json@20241224',
+          properties: [
+            {
+              name: 'syft:cpe23',
+              value: 'cpe:2.3:a:json:json:20241224:*:*:*:*:*:*:*'
+            }
+          ]
+        },
+        {
+          type: 'library',
+          group: 'com.oracle',
+          name: 'main-test-app',
+          version: '1.0-SNAPSHOT',
+          purl: 'pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT',
+          'bom-ref': 'pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT'
+        }
+      ],
+      dependencies: [
+        {
+          ref: 'pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT',
+          dependsOn: ['pkg:maven/org.json/json@20241224']
+        },
+        {
+          ref: 'pkg:maven/org.json/json@20241224',
+          dependsOn: []
+        }
+      ]
+    }
+
+    it('should process SBOM and display components', async () => {
+      await setUpAndProcessSBOM(sampleSBOM)
+
+      expect(spyInfo).toHaveBeenCalledWith(
+        'Found SBOM: ' + join(workspace, 'test.sbom.json')
+      )
+      expect(spyInfo).toHaveBeenCalledWith('=== SBOM Content ===')
+      expect(spyInfo).toHaveBeenCalledWith('- pkg:maven/org.json/json@20241224')
+      expect(spyInfo).toHaveBeenCalledWith(
+        '- pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT'
+      )
+      expect(spyInfo).toHaveBeenCalledWith(
+        '   depends on: pkg:maven/org.json/json@20241224'
+      )
+      expect(spyWarning).not.toHaveBeenCalled()
+    })
+
+    it('should handle components without purl', async () => {
+      const sbomWithoutPurl = {
+        ...sampleSBOM,
+        components: [
+          {
+            type: 'library',
+            name: 'no-purl-package',
+            version: '1.0.0',
+            'bom-ref': 'no-purl-package@1.0.0'
+          }
+        ]
+      }
+      await setUpAndProcessSBOM(sbomWithoutPurl)
+
+      expect(spyInfo).toHaveBeenCalledWith('=== SBOM Content ===')
+      expect(spyInfo).toHaveBeenCalledWith('- no-purl-package@1.0.0')
+      expect(spyWarning).not.toHaveBeenCalled()
+    })
+
+    it('should handle missing SBOM file', async () => {
+      setUpSBOMSupport(javaVersion, distribution)
+      spyInfo.mockClear()
+
+      mockFindSBOM([])
+
+      await expect(processSBOM()).rejects.toBeInstanceOf(Error)
+    })
+
+    it('should throw when JSON contains an invalid SBOM', async () => {
+      const invalidSBOM = {
+        'out-of-spec-field': {}
+      }
+      try {
+        await setUpAndProcessSBOM(invalidSBOM)
+        fail('Expected an error since invalid JSON was passed')
+      } catch (error) {
+        expect(error).toBeInstanceOf(Error)
+      }
+    })
+
+    it('should submit dependencies when processing valid SBOM', async () => {
+      const mockOctokit = mockGithubAPIReturnValue(undefined)
+      await setUpAndProcessSBOM(sampleSBOM)
+
+      expect(mockOctokit.request).toHaveBeenCalledWith(
+        'POST /repos/{owner}/{repo}/dependency-graph/snapshots',
+        expect.objectContaining({
+          owner: 'test-owner',
+          repo: 'test-repo',
+          version: expect.any(Number),
+          sha: 'test-sha',
+          ref: 'test-ref',
+          job: expect.objectContaining({
+            correlator: 'test-workflow_test-job',
+            id: '12345'
+          }),
+          manifests: expect.objectContaining({
+            'test.sbom.json': expect.objectContaining({
+              name: 'test.sbom.json',
+              resolved: expect.objectContaining({
+                json: expect.objectContaining({
+                  package_url: 'pkg:maven/org.json/json@20241224',
+                  dependencies: []
+                }),
+                'main-test-app': expect.objectContaining({
+                  package_url:
+                    'pkg:maven/com.oracle/main-test-app@1.0-SNAPSHOT',
+                  dependencies: ['pkg:maven/org.json/json@20241224']
+                })
+              })
+            })
+          })
+        })
+      )
+      expect(spyInfo).toHaveBeenCalledWith(
+        'Dependency snapshot submitted successfully.'
+      )
+    })
+
+    it('should handle GitHub API submission errors gracefully', async () => {
+      mockGithubAPIReturnValue(new Error('API submission failed'))
+
+      await expect(setUpAndProcessSBOM(sampleSBOM)).rejects.toBeInstanceOf(
+        Error
+      )
+    })
+  })
+})