Add SPDX SBOM generation to build-and-publish workflow

doc/changes/unreleased.md

@@ -1,3 +1,7 @@
 # Unreleased
 
 ## Summary
+
+## Features
+
+* #905: Added SPDX SBOM generation to the `build-and-publish.yml` with the new Nox session `dependency:sbom`

doc/user_guide/features/github_workflows/index.rst

@@ -64,7 +64,9 @@ Maintained by the PTB
      - Description
    * - ``build-and-publish.yml``
      - Workflow call
-     - Packages the distribution and publishes it to PyPi and GitHub.
+     - Packages the distribution and publishes it to PyPI, and creates a GitHub release
+       that includes an SPDX SBOM v2.
+
    * - ``cd.yml``
      - Push with new tag
      - Manages continuous delivery by creating and uploading build artifacts and

exasol/toolbox/nox/_dependencies.py

@@ -100,3 +100,27 @@ def report_resolved_vulnerabilities(session: Session) -> None:
         current_vulnerabilities=get_vulnerabilities(path),
     )
     print(audit.report_resolved_vulnerabilities())
+
+
+@nox.session(name="dependency:sbom", python=False)
+def generate_sbom(session: Session) -> None:
+    """Generate SPDX SBOM for the project dependencies.
+
+    Note: SPDX version 2 is used as no stable Python tool exists yet
+    for generating SPDX version 3.
+    """
+    bom_cdx_json = PROJECT_CONFIG.root_path / "bom.cdx.json"
+    bom_spdx_json = PROJECT_CONFIG.root_path / "bom.spdx.json"
+    session.run("cyclonedx-py", "environment", "-o", bom_cdx_json)
+    session.run(
+        "sbomconvert",
+        "-i",
+        bom_cdx_json,
+        "--sbom",
+        "spdx",
+        "--format",
+        "json",
+        "-o",
+        bom_spdx_json,
+    )
+    session.run("test", "-s", bom_spdx_json)

exasol/toolbox/templates/github/workflows/build-and-publish.yml

@@ -31,6 +31,10 @@ jobs:
         id: build-artifacts
         run: poetry build
 
+      - name: Generate SBOM
+        id: generate-sbom
+        run: poetry run -- nox -s dependency:sbom
+
       - name: Publish Release to PyPi
         id: publish-release-to-pypi
         env:
@@ -47,3 +51,4 @@ jobs:
           --title ${GITHUB_REF_NAME}
           --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md
           dist/*
+          bom.spdx.json