feat: sbom generation ubuntu and nix packages

.github/workflows/ami-release-nix.yml

@@ -222,6 +222,36 @@ jobs:
 
           echo "Catalog uploaded to ${CATALOG_S3}"
 
+      - name: Assume SBOM artifacts role
+        uses: aws-actions/configure-aws-credentials@v4.1.0
+        with:
+          aws-region: ap-southeast-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
+          role-session-name: shared-services-jump
+
+      - name: Upload comprehensive SBOM to shared artifacts
+        uses: aws-actions/configure-aws-credentials@v4.1.0
+        with:
+          aws-region: ap-southeast-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-sbom-artifacts-role
+          role-skip-session-tagging: true
+          role-session-name: upload-sbom
+          role-chaining: true
+
+      - name: Upload SBOM
+        run: |
+          VERSION="${{ steps.process_release_version.outputs.version }}"
+
+          if [ -f "nix-sbom.spdx.json" ]; then
+            aws s3 cp nix-sbom.spdx.json \
+              "s3://${{ secrets.SHARED_AWS_ARTIFACTS_BUCKET }}/sbom/${VERSION}/sbom.spdx.json" \
+              --content-type "application/json"
+            echo "::notice title=SBOM Uploaded::Comprehensive SBOM for ${VERSION} uploaded to shared artifacts"
+          else
+            echo "::error title=SBOM Missing::SBOM file not found - build cannot proceed without SBOM"
+            exit 1
+          fi
+
       - name: Create release
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:

.gitignore

@@ -33,3 +33,8 @@ common-nix.vars.pkr.hcl
 nixos.qcow2
 .lsp
 .clj-kondo
+#sbom development files
+http_cache.sqlite
+nix-sbom.spdx.json
+sbom.cdx.json
+sbom.csv

ansible/playbook.yml

@@ -235,6 +235,34 @@
         /bin/bash /tmp/ansible-playbook/ansible/files/supascan_ami.sh /tmp/ansible-playbook/audit-specs/baselines/ami-build
       when: stage2_nix and qemu_mode is not defined
 
+    - name: Free disk space before SBOM generation
+      become: yes
+      shell: |
+        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && \
+          nix-collect-garbage -d"
+      when: stage2_nix
+
+    - name: Install sbom-from-profiles
+      become: yes
+      shell: |
+        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && \
+          nix profile install github:supabase/postgres/{{ git_commit_sha }}#sbom-from-profiles"
+      when: stage2_nix
+
+    - name: Generate combined SBOM
+      become: yes
+      shell: |
+        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && \
+          sbom-from-profiles /tmp/nix-sbom.spdx.json"
+      when: stage2_nix
+
+    - name: Remove sbom-from-profiles
+      become: yes
+      shell: |
+        sudo -u ubuntu bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && \
+          nix profile remove sbom-from-profiles"
+      when: stage2_nix
+
     - name: Remove supascan after validation
       become: yes
       shell: |