Add workflow code to generate SBOMs and upload them to the release/pre-release by jsf9k · Pull Request #41 · cisagov/skeleton-aws-lambda-python

jsf9k · 2026-01-21T20:37:07Z

🗣 Description

This pull request:

Adds workflow code to generate SBOMs for the Lambda package
If we happen to be building a release or pre-release then the SBOMs will be uploaded to the release or pre-release.
Adds workflow code to create provenance attestations for the SBOMs and the Lambda package
Adds workflow code to create SBOM attestations for the Lambda package

💭 Motivation and context

CISA advocates for the use of SBOMs, so we should be generating them for our software products.

🧪 Testing

All automated tests pass.

✅ Pre-approval checklist

This PR has an informative and human-readable title.
Changes are limited to a single goal - eschew scope creep!
All relevant type-of-change labels have been added.
I have read the CONTRIBUTING document.
These code changes follow cisagov code standards.
All new and existing tests pass.
Bump major, minor, patch, pre-release, and/or build versions as appropriate via the bump_version script if this repository is versioned and the changes in this PR warrant a version bump.
Create a pre-release (necessary if and only if the pre-release version was bumped).

✅ Pre-merge checklist

Finalize version.
Mark SBOM checks as required.

✅ Post-merge checklist

Create a release (necessary if and only if the version was bumped).

…ions

Thus our SBOMs are named, e.g., cisagov-skeleton-aws-lambda-python.spdx-json rather than sbom.spdx-json.

The latest release supports the artifact-metadata permission that we are now using in the generate-sbom job of the build.yml GitHub Actions workflow.

This should have been done in #34 but was not.

mcdonnnj · 2026-01-26T18:53:02Z

+    #
+    # This job is located in this workflow as opposed to a separate
+    # release workflow because it only makes sense to run it after the
+    # build job.  Putting it in a separate release workflow would


Why does this need to run after the build job?

If the build job fails then we probably don't care to create an SBOM.

mcdonnnj · 2026-01-26T18:54:21Z

+    # build job.  Putting it in a separate release workflow would
+    # require us to introduce a dependency of the release workflow on
+    # this one.
+    if: github.event_name != 'pull_request'


This workflow also runs on push, merge_group, and repository_dispatch. Is there a reason we want this job to run against all of those, but not on pull_request events?

We don't want it to run on pull_request because of the contents: write permission.

It's probably worth adding a comment to that effect here.

I copied that from the build-push-all job from the build.yml workflow of cisagov/skeleton-docker but misunderstood why it was there. Please see commit f9ebf57.

That works for me, thanks.

mcdonnnj · 2026-01-26T18:55:19Z

+      - name: Update core Python packages
+        run: python -m pip install --upgrade pip setuptools wheel
+      - name: Install pipenv
+        run: pip install --upgrade pipenv


Is there a reason we're doing this?

That was copied and pasted from cisagov/skeleton-aws-lambda-python. You're right, it isn't needed or wanted here. Please see commit eeb63c5.

These steps were copied and pasted from cisagov/skeleton-python-library but are not needed here. Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

jsf9k · 2026-01-26T19:32:13Z

You can see the generated SBOMs in a workflow run or in a (pre-)release.

dav3r

SBOMs away! 💣

The if statement is present to to keep the push and pull_request events from both causing the job to be run. Co-authored-by: dav3r <david.redmin@gwe.cisa.dhs.gov> Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Copilot

Pull request overview

This PR introduces GitHub Actions workflow support to generate SBOMs as part of the build pipeline, with the stated intent to upload them to releases/pre-releases, and updates versioning/tooling files accordingly.

Changes:

Add a new generate-sbom job to the build workflow to generate SBOMs (CycloneDX + SPDX) and create provenance attestations.
Bump the project version to 0.1.0-rc.1 and remove the legacy bump_version.sh script.
Update pre-commit hook revision and annotate Dependabot ignore list for new actions.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`src/version.txt`	Version bump to `0.1.0-rc.1`.
`bump_version.sh`	Removes legacy version bump script.
`.pre-commit-config.yaml`	Updates `check-jsonschema` hook revision.
`.github/workflows/build.yml`	Adds SBOM generation + provenance attestation job.
`.github/dependabot.yml`	Adds commented ignore entries for new GitHub Actions dependencies.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-13T18:52:06Z

+    # Generate an SBOM from the Pipfile.lock file and, if there is a
+    # release, upload it as an asset to the release.
+    #
+    # This job is located in this workflow as opposed to a separate
+    # release workflow because it only makes sense to run it after the


This job is described/named as uploading SBOMs to a release/pre-release, but the workflow is not triggered by release events and there is no step that actually uploads the generated SBOM to a GitHub release asset. Add an explicit conditional release-upload step (e.g., via gh release upload or a release action) and/or add an appropriate trigger/condition (tag push or on: release) so the intended behavior actually occurs.

I verified that the code works as is. See, e.g., this pre-release.

Copilot · 2026-02-13T18:52:06Z

+        with:
+          path: ${{ env.PIP_CACHE_DIR }}
+          key: ${{ env.BASE_CACHE_KEY }}\
+            ${{ hashFiles('build/pyproject.toml') }}


The cache key hashes build/pyproject.toml, but that file does not exist in this repository. This makes the cache key effectively constant and risks stale/incorrect caches. Either remove this cache step (SBOM generation doesn’t install Python deps) or hash an existing dependency lockfile (e.g., build/Pipfile.lock) if caching is needed.

Suggested change

${{ hashFiles('build/pyproject.toml') }}

${{ hashFiles('build/Pipfile.lock') }}

Please see commit 212c684.

The latter doesn't exist in this project.

Note that actions/attest-build-provenance has changed its name to actions/attest, partly because it now supports different types of attestations. One such type is an SBOM attestation, which we are now using here.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

I.e., not for the `Pipfile.lock` file. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

jsf9k · 2026-03-10T19:30:50Z

I think the two failing tests will pass once #44 is merged. I will test that when I start to merge PRs for this skeleton.

felddy

Looks good.

Related but not in-scope here... we should consider ingesting the signatures and attestations where these lambda's are deployed. I can't remember what the exact facility was in AWS, but I think Nitro Enclaves touched upon it many moons ago.

Strong work!

jsf9k added 2 commits January 21, 2026 15:31

Add code to generate SBOMs and add them to release as assets

e92e250

Add (commented out) Dependabot ignore directives for SBOM-related act…

83b4c97

…ions

jsf9k self-assigned this Jan 21, 2026

jsf9k added this to Next Kraken and Skeleton Maintenance Jan 21, 2026

github-project-automation Bot moved this to In progress in Skeleton Maintenance Jan 21, 2026

jsf9k moved this to In Progress in Next Kraken Jan 21, 2026

jsf9k removed the status in Skeleton Maintenance Jan 21, 2026

github-actions Bot added the github-actions Pull requests that update GitHub Actions code label Jan 21, 2026

jsf9k force-pushed the feature/add-sbom branch 2 times, most recently from 8bc7e6b to 83b4c97 Compare January 21, 2026 20:43

jsf9k moved this to In progress in Skeleton Maintenance Jan 21, 2026

Manipulate the repo name and use that in the SBOM file name

b39819f

Thus our SBOMs are named, e.g., cisagov-skeleton-aws-lambda-python.spdx-json rather than sbom.spdx-json.

jsf9k force-pushed the feature/add-sbom branch from 4186622 to b39819f Compare January 26, 2026 15:17

Upgrade to the latest release of the check-jsonschema pre-commit hook

769fdb3

The latest release supports the artifact-metadata permission that we are now using in the generate-sbom job of the build.yml GitHub Actions workflow.

github-actions Bot added the dependencies Pull requests that update a dependency file label Jan 26, 2026

jsf9k added 2 commits January 26, 2026 13:26

Remove bump_version.sh

b672904

This should have been done in #34 but was not.

Bump version from 0.0.3 to 0.1.0-rc.1

f2f5857

github-actions Bot added version bump This issue or pull request increments the version number shell script Pull requests that update shell scripts labels Jan 26, 2026

jsf9k marked this pull request as ready for review January 26, 2026 18:41

jsf9k requested review from dav3r, felddy and mcdonnnj as code owners January 26, 2026 18:41

jsf9k moved this from In progress to Review in progress in Skeleton Maintenance Jan 26, 2026

mcdonnnj reviewed Jan 26, 2026

View reviewed changes

Remove unnecessary steps

eeb63c5

These steps were copied and pasted from cisagov/skeleton-python-library but are not needed here. Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

dav3r mentioned this pull request Jan 26, 2026

Add workflow code to generate SBOMs and upload them to the release/pre-release cisagov/skeleton-python-library#179

Open

7 tasks

dav3r approved these changes Jan 26, 2026

View reviewed changes

jsf9k force-pushed the feature/add-sbom branch from c888677 to eeb63c5 Compare January 27, 2026 02:21

Add a comment explaining why an if statement is present

f9ebf57

The if statement is present to to keep the push and pull_request events from both causing the job to be run. Co-authored-by: dav3r <david.redmin@gwe.cisa.dhs.gov> Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

jsf9k requested a review from mcdonnnj January 27, 2026 03:47

dav3r requested a review from Copilot February 13, 2026 18:45

Copilot started reviewing on behalf of dav3r February 13, 2026 18:46 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

jsf9k added 4 commits February 23, 2026 11:07

Upgrade actions/cache to match version used in parent skeleton

e4d01d1

Clean up definitions of cache keys to match upstream

3d8ee06

Hash against Pipfile.lock, not pyproject.toml

212c684

The latter doesn't exist in this project.

Upgrade to the latest name and version for the attestation action

23c6a11

Note that actions/attest-build-provenance has changed its name to actions/attest, partly because it now supports different types of attestations. One such type is an SBOM attestation, which we are now using here.

dav3r approved these changes Mar 10, 2026

View reviewed changes

jsf9k added 2 commits March 10, 2026 11:17

Add a comment explaining why a permission is necessary

7eecc0b

Add provenance attestation for the SBOM

cf74692

jsf9k requested a review from dav3r March 10, 2026 17:01

Add provenance attestation for Lambda deployment pacakge

18b2a5b

jsf9k force-pushed the feature/add-sbom branch from 5ad0aa4 to 18b2a5b Compare March 10, 2026 17:41

jsf9k requested a review from Copilot March 10, 2026 18:56

Copilot started reviewing on behalf of jsf9k March 10, 2026 18:56 View session

dav3r approved these changes Mar 10, 2026

View reviewed changes

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Comment thread .github/workflows/build.yml

Comment thread .github/workflows/build.yml Outdated

Comment thread .github/workflows/build.yml Outdated

jsf9k and others added 2 commits March 10, 2026 15:16

Pare down permissions

9b53685

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Create the SBOM attestation specifically for the Lambda package

46d76bb

I.e., not for the `Pipfile.lock` file. Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

felddy approved these changes Apr 17, 2026

View reviewed changes

github-project-automation Bot moved this from Review in progress to Reviewer approved in Skeleton Maintenance Apr 17, 2026

	${{ hashFiles('build/pyproject.toml') }}
	${{ hashFiles('build/Pipfile.lock') }}

Conversation

jsf9k commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🗣 Description

💭 Motivation and context

🧪 Testing

✅ Pre-approval checklist

✅ Pre-merge checklist

✅ Post-merge checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsf9k Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsf9k commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dav3r left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jsf9k commented Mar 10, 2026

Uh oh!

felddy left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jsf9k commented Jan 21, 2026 •

edited

Loading

jsf9k Jan 27, 2026 •

edited

Loading

jsf9k commented Jan 26, 2026 •

edited

Loading