Add CycloneDX SBOM generation for staging images#3833
Conversation
Added continue-on-error flag to SBOM generation steps.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdd CycloneDX SBOM generation Makefile targets for backend and frontend images, add CI steps in scan-staging-images to run those targets and upload Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/run-ci-cd.yaml:
- Around line 556-570: The SBOM steps "Generate SBOM for backend image" and
"Generate SBOM for frontend image" call the local trivy binary which isn't
installed on the runner and are masked by continue-on-error; replace these steps
to run Trivy the same way as the earlier scans by either (A) using the
aquasecurity/trivy-action action (preferred) or (B) invoking the official Docker
image aquasec/trivy:0.69.1 (docker run ... image --format cyclonedx --output
...) so the scanner runs inside a container, or (C) add Makefile targets (e.g.,
make sbom-backend, make sbom-frontend) that perform the docker-run invocation
and call those targets from the workflow; ensure continue-on-error is removed so
failures surface.
🧹 Nitpick comments (2)
.github/workflows/run-ci-cd.yaml (2)
572-578: Upload step should also be guarded withcontinue-on-erroror anifcondition.If both SBOM generation steps fail (which they will per the above), the output files won't exist. While
actions/upload-artifactdefaults towarnfor missing files, it's better to be explicit — either addcontinue-on-error: trueor gate withif: always()and setif-no-files-found: ignoreto make the non-blocking intent clear and resilient.- name: Upload SBOM artifacts + if: always() uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f with: name: staging-sboms path: | backend-sbom.cdx.json frontend-sbom.cdx.json + if-no-files-found: warn
916-938: Consider adding SBOM generation to the production scan job as well.The linked issue (
#3775) emphasizes supply-chain transparency for shipped images. Currently, SBOMs are only generated for staging images. For parity and to satisfy the goal of enabling post-release CVE impact analysis, the same SBOM steps should be added to thescan-production-imagesjob (and ideally attached as release assets).
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Confidence score: 3/5
- CI/CD risk:
run-ci-cd.yamlinvokes thetrivyCLI directly even though it isn’t available on GitHub runners, which can cause the workflow to fail and block merges/deploys. - Score reflects a concrete, high-severity (8/10) pipeline break risk rather than a functional code bug.
- Pay close attention to
.github/workflows/run-ci-cd.yaml- Trivy is called without the container-based setup used elsewhere.
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name=".github/workflows/run-ci-cd.yaml">
<violation number="1" location=".github/workflows/run-ci-cd.yaml:559">
P1: The `trivy` CLI is not available on the GitHub Actions runner. The existing security scans in this workflow invoke Trivy via Docker containers through Makefile targets (`docker run aquasec/trivy:0.69.1`), but this step calls `trivy image` directly on the runner where it's not installed. Combined with `continue-on-error: true`, this will fail silently and no SBOMs will be generated while the job appears to succeed.
To fix, either:
1. Use `aquasecurity/trivy-action` GitHub Action
2. Run Trivy via Docker consistent with existing scans:
```yaml
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
aquasec/trivy:0.69.1 image --format cyclonedx \
--output backend-sbom.cdx.json owasp/nest:backend-staging
- Add SBOM targets to the Makefile and call those instead
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
Hiii @arkid15r , Testing note: Test workflow run: Generated SBOM artifacts: |
arkid15r
left a comment
arkid15r
left a comment
There was a problem hiding this comment.
This is a good idea to upload artifacts for staging images. For production we want to attach SBOMs to GitHub release.
There was a problem hiding this comment.
2 issues found across 3 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="frontend/Makefile">
<violation number="1" location="frontend/Makefile:80">
P2: Missing image-existence guard: unlike the adjacent `security-scan-frontend-image` target, this new target doesn't check whether the default local image exists and build it first. Running `make sbom-frontend-image` with the default `FRONTEND_IMAGE_NAME=nest-frontend-local` will fail if the image hasn't already been built.
(Based on your team's feedback about reusing existing patterns for CI and security scanner configuration.) [FEEDBACK_USED]</violation>
</file>
<file name="backend/Makefile">
<violation number="1" location="backend/Makefile:185">
P2: Missing auto-build guard for local image. The existing `security-scan-backend-image` target checks if `BACKEND_IMAGE_NAME` is the default `nest-backend-local` and builds it first if needed. This target lacks that guard, so `make sbom-backend-image` will fail locally if the image hasn't been pre-built. Add the same conditional build step for consistency and usability.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
|
Hii @arkid15r , |
|
There was a problem hiding this comment.
1 issue found across 4 files (changes from recent commits).
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name=".github/workflows/run-ci-cd.yaml">
<violation number="1" location=".github/workflows/run-ci-cd.yaml:945">
P1: SBOM generation steps are blocking and will prevent deployment on failure. The `continue-on-error: true` was removed from both staging SBOM steps, and the new production SBOM steps also lack it. Since `deploy-staging-nest` and `deploy-production-nest` depend on their respective scan jobs, any SBOM generation failure (e.g., Trivy timeout, network issue) will block deployment. Consider adding `continue-on-error: true` if the intent is truly non-blocking, or update the PR description to reflect that SBOM failures intentionally block deployment.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3833 +/- ##
=======================================
Coverage 95.39% 95.39%
=======================================
Files 463 463
Lines 14540 14540
Branches 2017 2017
=======================================
Hits 13871 13871
Misses 328 328
Partials 341 341
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
arkid15r
left a comment
arkid15r
left a comment
There was a problem hiding this comment.
I updated it a bit, let's see if this works.
2 participants
Proposed change
Resolves #3775
This PR adds CycloneDX SBOM generation for staging Docker images as part of the existing
scan-staging-imagesjob.SBOMs are generated in CycloneDX (JSON) format using Trivy for both backend and frontend staging images and uploaded as CI artifacts.
SBOM generation is intentionally non-blocking to avoid disrupting the existing CI/CD pipeline, while still providing supply chain visibility.
Checklist
make check-testlocally: all warnings addressed, tests passed