From 7b5683a97cd3f04a87eaad5a5793ced5d237170c Mon Sep 17 00:00:00 2001 From: Rimsha Masood Date: Tue, 11 Aug 2026 10:10:21 +0200 Subject: [PATCH 1/8] Add project name and version context to SBOM file name --- .github/workflows/build-and-publish.yml | 9 +++++-- exasol/toolbox/nox/_dependencies.py | 27 ++++++++++++++++++- .../github/workflows/build-and-publish.yml | 9 +++++-- test/unit/nox/_dependencies_test.py | 11 +++++++- 4 files changed, 50 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index 2ad4b219b..d7b15c2c3 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -35,7 +35,12 @@ jobs: - name: Generate SBOM id: generate-sbom run: poetry run -- nox -s dependency:sbom - + - name: Rename SBOM + id: rename-sbom + run: | + SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}') + mv bom.spdx.json $SBOM_NAME + echo "SBOM_NAME=$SBOM_NAME" >> $GITHUB_ENV - name: Publish Release to PyPi id: publish-release-to-pypi env: @@ -52,4 +57,4 @@ jobs: --title ${GITHUB_REF_NAME} --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md dist/* - bom.spdx.json + ${{ env.SBOM_NAME }} diff --git a/exasol/toolbox/nox/_dependencies.py b/exasol/toolbox/nox/_dependencies.py index c178e76a2..c13c85c85 100644 --- a/exasol/toolbox/nox/_dependencies.py +++ b/exasol/toolbox/nox/_dependencies.py @@ -2,6 +2,7 @@ import argparse import json +import subprocess from pathlib import Path import nox @@ -21,6 +22,10 @@ from exasol.toolbox.util.dependencies.poetry_dependencies import get_dependencies from exasol.toolbox.util.dependencies.track_vulnerabilities import DependenciesAudit from exasol.toolbox.util.dependencies.update_dependencies import DependencyUpdater +from exasol.toolbox.util.version import ( + Version, + poetry_command, +) from noxconfig import PROJECT_CONFIG @@ -102,6 +107,22 @@ def report_resolved_vulnerabilities(session: Session) -> None: print(audit.report_resolved_vulnerabilities()) +@poetry_command +def project_name_and_version_from_poetry( + working_directory: Path | None = None, +) -> tuple[str, Version]: + """Return the project name and version reported by Poetry.""" + output = subprocess.run( # nosec: B603, B607 + ["poetry", "version", "--no-ansi"], + cwd=working_directory, + capture_output=True, + text=True, + check=True, + ) + project_name, version = output.stdout.strip().rsplit(maxsplit=1) + return project_name.replace("-", "_"), Version.from_string(version) + + @nox.session(name="dependency:sbom", python=False) def generate_sbom(session: Session) -> None: """Generate SPDX SBOM for the project dependencies. @@ -109,8 +130,12 @@ def generate_sbom(session: Session) -> None: Note: SPDX version 2 is used as no stable Python tool exists yet for generating SPDX version 3. """ + project_name, version = project_name_and_version_from_poetry( + working_directory=PROJECT_CONFIG.root_path + ) + sbom_filename = f"{project_name}-{version}.spdx.json" bom_cdx_json = PROJECT_CONFIG.root_path / "bom.cdx.json" - bom_spdx_json = PROJECT_CONFIG.root_path / "bom.spdx.json" + bom_spdx_json = PROJECT_CONFIG.root_path / sbom_filename session.run("cyclonedx-py", "environment", "-o", bom_cdx_json) session.run( "sbomconvert", diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index d645beca7..157e824f3 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -34,7 +34,12 @@ jobs: - name: Generate SBOM id: generate-sbom run: poetry run -- nox -s dependency:sbom - + - name: Rename SBOM + id: rename-sbom + run: | + SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}') + mv bom.spdx.json $SBOM_NAME + echo "SBOM_NAME=$SBOM_NAME" >> $GITHUB_ENV - name: Publish Release to PyPi id: publish-release-to-pypi env: @@ -51,4 +56,4 @@ jobs: --title ${GITHUB_REF_NAME} --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md dist/* - bom.spdx.json + ${{ env.SBOM_NAME }} diff --git a/test/unit/nox/_dependencies_test.py b/test/unit/nox/_dependencies_test.py index e7888bfd6..f612c4d37 100644 --- a/test/unit/nox/_dependencies_test.py +++ b/test/unit/nox/_dependencies_test.py @@ -6,6 +6,7 @@ from exasol.toolbox.nox import _dependencies from exasol.toolbox.nox import _shared as nox_shared from exasol.toolbox.util.dependencies.audit import Vulnerabilities +from exasol.toolbox.util.version import Version @pytest.mark.parametrize( @@ -91,10 +92,18 @@ def test_report_resolved_vulnerabilities( def test_generate_sbom(monkeypatch, nox_session, tmp_path, test_project_config_factory): project_config = test_project_config_factory(root_path=tmp_path) monkeypatch.setattr(_dependencies, "PROJECT_CONFIG", project_config) + monkeypatch.setattr( + _dependencies, + "project_name_and_version_from_poetry", + lambda working_directory=None: ( + "exasol_toolbox", + Version.from_string("10.3.0"), + ), + ) _dependencies.generate_sbom(nox_session) - expected_file = tmp_path / "bom.spdx.json" + expected_file = tmp_path / "exasol_toolbox-10.3.0.spdx.json" bom_spdx_json = json.loads(expected_file.read_text()) assert bom_spdx_json["SPDXID"] == "SPDXRef-DOCUMENT" assert bom_spdx_json["spdxVersion"] == "SPDX-2.3" From ae406e8c9ecc9d63b29e0a2259a3eefdb2f8e4d6 Mon Sep 17 00:00:00 2001 From: Rimsha Masood Date: Tue, 11 Aug 2026 10:48:34 +0200 Subject: [PATCH 2/8] Fix zizmor security warning: quote SBOM_NAME env variable --- .github/workflows/build-and-publish.yml | 2 +- exasol/toolbox/templates/github/workflows/build-and-publish.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index d7b15c2c3..7c42bd422 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -57,4 +57,4 @@ jobs: --title ${GITHUB_REF_NAME} --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md dist/* - ${{ env.SBOM_NAME }} + "${{ env.SBOM_NAME }}" diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index 157e824f3..f2c8818ec 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -56,4 +56,4 @@ jobs: --title ${GITHUB_REF_NAME} --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md dist/* - ${{ env.SBOM_NAME }} + "${{ env.SBOM_NAME }}" From b0e889f0f0d5d6c21263c461fe8932b4773aab9b Mon Sep 17 00:00:00 2001 From: Rimsha Masood <144063231+Rimsha2535@users.noreply.github.com> Date: Tue, 11 Aug 2026 14:10:13 +0200 Subject: [PATCH 3/8] Update exasol/toolbox/templates/github/workflows/build-and-publish.yml Co-authored-by: Ariel Schulz <43442541+ArBridgeman@users.noreply.github.com> --- exasol/toolbox/templates/github/workflows/build-and-publish.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index f2c8818ec..241b3421a 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -38,7 +38,6 @@ jobs: id: rename-sbom run: | SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}') - mv bom.spdx.json $SBOM_NAME echo "SBOM_NAME=$SBOM_NAME" >> $GITHUB_ENV - name: Publish Release to PyPi id: publish-release-to-pypi From b972c6f4952f43383ee3f30cd5d6b51ca7a04166 Mon Sep 17 00:00:00 2001 From: Rimsha Masood <144063231+Rimsha2535@users.noreply.github.com> Date: Tue, 11 Aug 2026 14:10:53 +0200 Subject: [PATCH 4/8] Update exasol/toolbox/templates/github/workflows/build-and-publish.yml Co-authored-by: Ariel Schulz <43442541+ArBridgeman@users.noreply.github.com> --- exasol/toolbox/templates/github/workflows/build-and-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index 241b3421a..832dcfcad 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -38,7 +38,7 @@ jobs: id: rename-sbom run: | SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}') - echo "SBOM_NAME=$SBOM_NAME" >> $GITHUB_ENV + echo "sbom-name=$SBOM_NAME" >> "$GITHUB_OUTPUT" - name: Publish Release to PyPi id: publish-release-to-pypi env: From 3e52a0c68bd5bf2deb5fb166959578d4ddca1dcf Mon Sep 17 00:00:00 2001 From: Rimsha Masood <144063231+Rimsha2535@users.noreply.github.com> Date: Tue, 11 Aug 2026 14:11:41 +0200 Subject: [PATCH 5/8] Update exasol/toolbox/templates/github/workflows/build-and-publish.yml Co-authored-by: Ariel Schulz <43442541+ArBridgeman@users.noreply.github.com> --- exasol/toolbox/templates/github/workflows/build-and-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index 832dcfcad..d5e2ccf51 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -49,7 +49,7 @@ jobs: - name: Publish Release to GitHub id: publish-release-to-github env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SBOM_NAME: ${{ steps.rename-sbom.outputs.sbom-name }} run: > gh release create ${GITHUB_REF_NAME} --title ${GITHUB_REF_NAME} From d275c064ca967caedd13ad706d425b1b7a10d0eb Mon Sep 17 00:00:00 2001 From: Rimsha Masood <144063231+Rimsha2535@users.noreply.github.com> Date: Tue, 11 Aug 2026 14:12:28 +0200 Subject: [PATCH 6/8] Update exasol/toolbox/templates/github/workflows/build-and-publish.yml Co-authored-by: Ariel Schulz <43442541+ArBridgeman@users.noreply.github.com> --- exasol/toolbox/templates/github/workflows/build-and-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index d5e2ccf51..4dd7ed05a 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -55,4 +55,4 @@ jobs: --title ${GITHUB_REF_NAME} --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md dist/* - "${{ env.SBOM_NAME }}" + "$SBOM_NAME" From d5a5edfe03594f970c7a77edb362bc892f8f8ef5 Mon Sep 17 00:00:00 2001 From: Rimsha Masood Date: Tue, 11 Aug 2026 19:15:15 +0200 Subject: [PATCH 7/8] Refactor SBOM generation to use nox session output --- .github/workflows/build-and-publish.yml | 12 +++++------ exasol/toolbox/nox/_dependencies.py | 21 ++----------------- .../github/workflows/build-and-publish.yml | 9 +++----- exasol/toolbox/util/version.py | 17 +++++++++++++++ 4 files changed, 27 insertions(+), 32 deletions(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index 7c42bd422..fd4d4fb7b 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -34,13 +34,10 @@ jobs: - name: Generate SBOM id: generate-sbom - run: poetry run -- nox -s dependency:sbom - - name: Rename SBOM - id: rename-sbom run: | - SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}') - mv bom.spdx.json $SBOM_NAME - echo "SBOM_NAME=$SBOM_NAME" >> $GITHUB_ENV + SBOM_NAME="$(poetry run -- nox -s dependency:sbom)" + echo "SBOM_NAME=$SBOM_NAME" >> "$GITHUB_OUTPUT" + - name: Publish Release to PyPi id: publish-release-to-pypi env: @@ -52,9 +49,10 @@ jobs: id: publish-release-to-github env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + SBOM_NAME: ${{ steps.generate-sbom.outputs.SBOM_NAME }} run: >- gh release create ${GITHUB_REF_NAME} --title ${GITHUB_REF_NAME} --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md dist/* - "${{ env.SBOM_NAME }}" + "$SBOM_NAME" diff --git a/exasol/toolbox/nox/_dependencies.py b/exasol/toolbox/nox/_dependencies.py index c13c85c85..ef8aec2b6 100644 --- a/exasol/toolbox/nox/_dependencies.py +++ b/exasol/toolbox/nox/_dependencies.py @@ -2,7 +2,6 @@ import argparse import json -import subprocess from pathlib import Path import nox @@ -23,8 +22,7 @@ from exasol.toolbox.util.dependencies.track_vulnerabilities import DependenciesAudit from exasol.toolbox.util.dependencies.update_dependencies import DependencyUpdater from exasol.toolbox.util.version import ( - Version, - poetry_command, + project_name_and_version_from_poetry, ) from noxconfig import PROJECT_CONFIG @@ -107,22 +105,6 @@ def report_resolved_vulnerabilities(session: Session) -> None: print(audit.report_resolved_vulnerabilities()) -@poetry_command -def project_name_and_version_from_poetry( - working_directory: Path | None = None, -) -> tuple[str, Version]: - """Return the project name and version reported by Poetry.""" - output = subprocess.run( # nosec: B603, B607 - ["poetry", "version", "--no-ansi"], - cwd=working_directory, - capture_output=True, - text=True, - check=True, - ) - project_name, version = output.stdout.strip().rsplit(maxsplit=1) - return project_name.replace("-", "_"), Version.from_string(version) - - @nox.session(name="dependency:sbom", python=False) def generate_sbom(session: Session) -> None: """Generate SPDX SBOM for the project dependencies. @@ -149,3 +131,4 @@ def generate_sbom(session: Session) -> None: bom_spdx_json, ) session.run("test", "-s", bom_spdx_json) + print(sbom_filename) diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index 4dd7ed05a..685032cb5 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -33,12 +33,9 @@ jobs: - name: Generate SBOM id: generate-sbom - run: poetry run -- nox -s dependency:sbom - - name: Rename SBOM - id: rename-sbom run: | - SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}') - echo "sbom-name=$SBOM_NAME" >> "$GITHUB_OUTPUT" + SBOM_NAME="$(poetry run -- nox -s dependency:sbom)" + echo "SBOM_NAME=$SBOM_NAME" >> "$GITHUB_OUTPUT" - name: Publish Release to PyPi id: publish-release-to-pypi env: @@ -49,7 +46,7 @@ jobs: - name: Publish Release to GitHub id: publish-release-to-github env: - SBOM_NAME: ${{ steps.rename-sbom.outputs.sbom-name }} + SBOM_NAME: ${{ steps.generate-sbom.outputs.SBOM_NAME }} run: > gh release create ${GITHUB_REF_NAME} --title ${GITHUB_REF_NAME} diff --git a/exasol/toolbox/util/version.py b/exasol/toolbox/util/version.py index 5fae4f8bd..40ba0e7c3 100644 --- a/exasol/toolbox/util/version.py +++ b/exasol/toolbox/util/version.py @@ -7,6 +7,7 @@ total_ordering, wraps, ) +from pathlib import Path from shutil import which from exasol.toolbox.error import ToolboxError @@ -104,3 +105,19 @@ def upgrade_version_from_poetry(t: ReleaseTypes): text=True, ) return Version.from_string(output.stdout.strip()) + + +@poetry_command +def project_name_and_version_from_poetry( + working_directory: Path | None = None, +) -> tuple[str, Version]: + """Return the project name and version reported by Poetry.""" + output = subprocess.run( # nosec: B603, B607 - allow fixed poetry command + ["poetry", "version", "--no-ansi"], + cwd=working_directory, + capture_output=True, + text=True, + check=True, + ) + project_name, version = output.stdout.strip().rsplit(maxsplit=1) + return project_name.replace("-", "_"), Version.from_string(version) From d0e638545b8b06efa29aceb00a78df2d74a839e0 Mon Sep 17 00:00:00 2001 From: Rimsha Masood Date: Tue, 11 Aug 2026 19:29:26 +0200 Subject: [PATCH 8/8] Fix workflow: add GITHUB_TOKEN to env and remove extra blank line --- .github/workflows/build-and-publish.yml | 3 +-- .../toolbox/templates/github/workflows/build-and-publish.yml | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index fd4d4fb7b..2b8f1206d 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -1,5 +1,5 @@ # Generated and maintained by the exasol-toolbox. -# Last generated with exasol-toolbox version 10.4.0. +# Last generated with exasol-toolbox version 10.3.0. name: Build & Publish on: @@ -37,7 +37,6 @@ jobs: run: | SBOM_NAME="$(poetry run -- nox -s dependency:sbom)" echo "SBOM_NAME=$SBOM_NAME" >> "$GITHUB_OUTPUT" - - name: Publish Release to PyPi id: publish-release-to-pypi env: diff --git a/exasol/toolbox/templates/github/workflows/build-and-publish.yml b/exasol/toolbox/templates/github/workflows/build-and-publish.yml index 685032cb5..b51791cfb 100644 --- a/exasol/toolbox/templates/github/workflows/build-and-publish.yml +++ b/exasol/toolbox/templates/github/workflows/build-and-publish.yml @@ -46,6 +46,7 @@ jobs: - name: Publish Release to GitHub id: publish-release-to-github env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SBOM_NAME: ${{ steps.generate-sbom.outputs.SBOM_NAME }} run: > gh release create ${GITHUB_REF_NAME}