Skip to content

Commit 67e001a

Browse files
NiveditJainNiveditJain
committed
Enhance CI workflows with SBOM generation and security features
- Updated integration-tests.yml to set a working directory for tests. - Added SBOM generation steps in publish-python-sdk.yml and release-python-sdk.yml, including tools installation, SBOM creation in JSON and XML formats, and vulnerability report generation. - Updated README.md to document supply chain security features, including package provenance, SBOM details, and verification instructions for enhanced transparency and security compliance.
1 parent 14dd7ed commit 67e001a

4 files changed

Lines changed: 147 additions & 2 deletions

File tree

‎.github/workflows/integration-tests.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ on:
1111

1212
jobs:
1313
test:
14+
defaults:
15+
run:
16+
working-directory: integration-tests
17+
if: github.repository == 'exospherehost/exospherehost'
1418
runs-on: ubuntu-latest
1519
services:
1620
mongodb:

‎.github/workflows/publish-python-sdk.yml‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,37 @@ jobs:
9090
print(f'Version {version} is valid for PyPI publishing (contains beta indicator)')
9191
"
9292
93+
- name: Generate requirements file for SBOM
94+
run: |
95+
uv export --format=requirements-txt --output-file=requirements.txt
96+
echo "Generated requirements.txt for SBOM creation"
97+
98+
- name: Install SBOM generation tools
99+
run: |
100+
uv tool install cyclonedx-bom
101+
uv tool install pip-audit
102+
103+
- name: Generate SBOM with CycloneDX
104+
run: |
105+
uv tool run cyclonedx-py requirements --format json --output-file sbom-cyclonedx.json requirements.txt
106+
echo "Generated CycloneDX SBOM in JSON format"
107+
108+
- name: Generate vulnerability report with pip-audit
109+
run: |
110+
uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
111+
echo "Generated vulnerability report (non-blocking)"
112+
93113
- run: uv build
94114

95-
- run: uv publish
115+
- name: Publish to PyPI with provenance
116+
run: uv publish --provenance
117+
118+
- name: Upload SBOM artifacts
119+
uses: actions/upload-artifact@v4
120+
with:
121+
name: sbom-artifacts-beta-${{ github.sha }}
122+
path: |
123+
python-sdk/sbom-cyclonedx.json
124+
python-sdk/requirements.txt
125+
python-sdk/vulnerability-report.json
126+
retention-days: 30

‎.github/workflows/release-python-sdk.yml‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,72 @@ jobs:
122122
print(f'Version {version} is valid for release publishing')
123123
"
124124
125+
- name: Generate requirements file for SBOM
126+
run: |
127+
uv export --format=requirements-txt --output-file=requirements.txt
128+
echo "Generated requirements.txt for SBOM creation"
129+
130+
- name: Install SBOM generation tools
131+
run: |
132+
uv tool install cyclonedx-bom
133+
uv tool install pip-audit
134+
135+
- name: Generate SBOM with CycloneDX
136+
run: |
137+
uv tool run cyclonedx-py requirements --format json --output-file sbom-cyclonedx.json requirements.txt
138+
uv tool run cyclonedx-py requirements --format xml --output-file sbom-cyclonedx.xml requirements.txt
139+
echo "Generated CycloneDX SBOM in JSON and XML formats"
140+
141+
- name: Generate vulnerability report with pip-audit
142+
run: |
143+
uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
144+
echo "Generated vulnerability report (non-blocking)"
145+
146+
- name: Create SBOM summary
147+
run: |
148+
echo "## Software Bill of Materials (SBOM)" > sbom-summary.md
149+
echo "" >> sbom-summary.md
150+
echo "This release includes the following supply chain security artifacts:" >> sbom-summary.md
151+
echo "" >> sbom-summary.md
152+
echo "- **Provenance**: Cryptographic proof of build integrity using GitHub's OIDC tokens" >> sbom-summary.md
153+
echo "- **SBOM**: Complete dependency inventory in CycloneDX format" >> sbom-summary.md
154+
echo "- **Vulnerability Report**: Security scan results for all dependencies" >> sbom-summary.md
155+
echo "" >> sbom-summary.md
156+
echo "### Dependencies Count:" >> sbom-summary.md
157+
echo "- Direct dependencies: $(grep -c '^[^#]' requirements.txt || echo '0')" >> sbom-summary.md
158+
echo "- Total dependencies (including transitive): $(wc -l < requirements.txt)" >> sbom-summary.md
159+
echo "" >> sbom-summary.md
160+
echo "### Verification:" >> sbom-summary.md
161+
echo "You can verify this package's provenance on PyPI using:" >> sbom-summary.md
162+
echo '```bash' >> sbom-summary.md
163+
echo 'pip install sigstore' >> sbom-summary.md
164+
echo 'python -m sigstore verify --bundle <bundle-file> exospherehost==${{ github.ref_name }}' >> sbom-summary.md
165+
echo '```' >> sbom-summary.md
166+
125167
- run: uv build
126168

127-
- run: uv publish
169+
- name: Publish to PyPI with provenance
170+
run: uv publish --provenance
171+
172+
- name: Upload SBOM artifacts
173+
uses: actions/upload-artifact@v4
174+
with:
175+
name: sbom-artifacts-${{ github.ref_name }}
176+
path: |
177+
python-sdk/sbom-cyclonedx.json
178+
python-sdk/sbom-cyclonedx.xml
179+
python-sdk/requirements.txt
180+
python-sdk/vulnerability-report.json
181+
python-sdk/sbom-summary.md
182+
retention-days: 90
183+
184+
- name: Add SBOM to release assets
185+
uses: softprops/action-gh-release@v2
186+
if: startsWith(github.ref, 'refs/tags/')
187+
with:
188+
files: |
189+
python-sdk/sbom-cyclonedx.json
190+
python-sdk/sbom-cyclonedx.xml
191+
python-sdk/sbom-summary.md
192+
body_path: python-sdk/sbom-summary.md
193+
append_body: true

‎python-sdk/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,50 @@ export EXOSPHERE_API_KEY="your-api-key"
7979
- **Scalability**: Designed for high-volume batch processing and workflows
8080
- **Graph Store (beta)**: Strings-only key-value store with per-run scope for sharing data across nodes (not durable across separate runs or clusters)
8181

82+
## Supply Chain Security
83+
84+
The ExosphereHost Python SDK includes comprehensive supply chain security features to ensure package integrity and transparency:
85+
86+
### Package Provenance
87+
88+
All releases are published with cryptographic provenance using GitHub's OIDC tokens and the Sigstore ecosystem. This provides:
89+
90+
- **Cryptographic proof** that packages were built by the official ExosphereHost repository
91+
- **Tamper detection** to verify packages haven't been modified after publication
92+
- **Build transparency** showing exactly how and where packages were created
93+
94+
### Software Bill of Materials (SBOM)
95+
96+
Each release includes a complete Software Bill of Materials in industry-standard CycloneDX format:
97+
98+
- **Complete dependency inventory** listing all direct and transitive dependencies
99+
- **Vulnerability scanning** results for all dependencies
100+
- **License compliance** information for enterprise environments
101+
- **Version tracking** for security auditing and compliance
102+
103+
### Verification
104+
105+
You can verify the authenticity of any ExosphereHost package:
106+
107+
```bash
108+
# Install verification tools
109+
pip install sigstore
110+
111+
# Verify package provenance (replace X.Y.Z with actual version)
112+
python -m sigstore verify --bundle <bundle-file> exospherehost==X.Y.Z
113+
```
114+
115+
### Security Artifacts
116+
117+
For each release, you can find the following security artifacts:
118+
119+
- **SBOM files** (JSON and XML formats) attached to GitHub releases
120+
- **Vulnerability reports** showing security scan results
121+
- **Provenance attestations** available on PyPI
122+
- **Build logs** publicly available in GitHub Actions
123+
124+
These features align with modern software supply chain security best practices and help meet enterprise security requirements.
125+
82126
## Architecture
83127

84128
The SDK is built around two core concepts:

0 commit comments

Comments
 (0)