sbomify-action 0.10__py3-none-any.whl

sbomify_action/__init__.py

@@ -0,0 +1,60 @@
+"""sbomify-action package for SBOM generation and enrichment."""
+
+
+def _get_version() -> str:
+    """Get package version with fallback mechanisms.
+
+    Tries the following methods in order until one succeeds:
+    - importlib.metadata (preferred for installed packages)
+    - tomllib/pyproject.toml (Python 3.11+, for development)
+    - toml library/pyproject.toml (older Python, for development)
+    - Returns "unknown" if all methods fail
+    """
+    # Try importlib.metadata (preferred for installed packages)
+    try:
+        from importlib.metadata import version
+
+        return version("sbomify-action")
+    except ImportError:
+        pass
+    except Exception:
+        pass
+
+    # Try reading from pyproject.toml using tomllib (Python 3.11+)
+    try:
+        from pathlib import Path
+
+        import tomllib
+
+        pyproject_path = Path(__file__).parent.parent / "pyproject.toml"
+        if pyproject_path.exists():
+            with open(pyproject_path, "rb") as f:
+                pyproject_data = tomllib.load(f)
+            return pyproject_data.get("project", {}).get("version", "unknown")
+    except ImportError:
+        # Python < 3.11 doesn't have tomllib
+        pass
+    except Exception:
+        pass
+
+    # Try toml library as fallback for older Python
+    try:
+        from pathlib import Path
+
+        import toml
+
+        pyproject_path = Path(__file__).parent.parent / "pyproject.toml"
+        if pyproject_path.exists():
+            with open(pyproject_path, "r") as f:
+                pyproject_data = toml.load(f)
+            return pyproject_data.get("project", {}).get("version", "unknown")
+    except ImportError:
+        pass
+    except Exception:
+        pass
+
+    # Final fallback
+    return "unknown"
+
+
+__version__ = _get_version()

sbomify_action/_augmentation/__init__.py

@@ -0,0 +1,76 @@
+"""Augmentation plugin architecture for SBOM metadata providers.
+
+This module provides a plugin-based approach to fetching organizational
+metadata for SBOM augmentation. Multiple providers can supply metadata
+(supplier, authors, licenses, lifecycle_phase, VCS info), which is merged by priority.
+
+Providers (in priority order):
+- json-config: Reads from sbomify.json config file (priority 10)
+- github-actions: Auto-detects VCS info from GitHub Actions env (priority 20)
+- gitlab-ci: Auto-detects VCS info from GitLab CI env (priority 20)
+- bitbucket-pipelines: Auto-detects VCS info from Bitbucket Pipelines env (priority 20)
+- sbomify-api: Fetches from sbomify backend API (priority 50)
+
+VCS Augmentation:
+CI providers automatically detect repository URL, commit SHA, and branch/ref
+from CI environment variables. This can be:
+- Overridden via sbomify.json config (vcs_url, vcs_commit_sha, vcs_ref)
+- Disabled entirely via DISABLE_VCS_AUGMENTATION=true environment variable
+
+Usage:
+    from sbomify_action._augmentation import create_default_registry
+
+    registry = create_default_registry()
+    metadata = registry.fetch_metadata(
+        component_id="xxx",
+        api_base_url="https://app.sbomify.com",
+        token="your-token",
+    )
+"""
+
+from .metadata import AugmentationMetadata
+from .protocol import AugmentationProvider
+from .registry import ProviderRegistry
+
+__all__ = [
+    "AugmentationMetadata",
+    "AugmentationProvider",
+    "ProviderRegistry",
+    "create_default_registry",
+]
+
+
+def create_default_registry() -> ProviderRegistry:
+    """
+    Create a registry with default augmentation providers.
+
+    Providers are registered in priority order (lower number = higher priority):
+    - Priority 10: JsonConfigProvider (local config, can override CI-detected VCS)
+    - Priority 20: CI providers (GitHub Actions, GitLab CI, Bitbucket Pipelines)
+    - Priority 50: SbomifyApiProvider (backend metadata)
+
+    Returns:
+        ProviderRegistry configured with standard providers
+    """
+    from .providers import (
+        BitbucketPipelinesProvider,
+        GitHubActionsProvider,
+        GitLabCIProvider,
+        JsonConfigProvider,
+        SbomifyApiProvider,
+    )
+
+    registry = ProviderRegistry()
+
+    # Priority 10: Local config (can override CI-detected VCS)
+    registry.register(JsonConfigProvider())
+
+    # Priority 20: CI providers (auto-detect VCS from environment)
+    registry.register(GitHubActionsProvider())
+    registry.register(GitLabCIProvider())
+    registry.register(BitbucketPipelinesProvider())
+
+    # Priority 50: API provider (backend metadata)
+    registry.register(SbomifyApiProvider())
+
+    return registry

sbomify_action/_augmentation/metadata.py

@@ -0,0 +1,171 @@
+"""AugmentationMetadata dataclass for normalized augmentation data."""
+
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional
+
+
+@dataclass
+class AugmentationMetadata:
+    """
+    Normalized metadata for SBOM augmentation.
+
+    This dataclass represents the canonical format for augmentation data
+    from any provider. It includes fields for NTIA Minimum Elements and
+    CISA 2025 requirements.
+
+    Attributes:
+        supplier: Supplier information (name, urls, contacts)
+        manufacturer: Manufacturer information (name, urls, contacts, address)
+        authors: List of author information
+        licenses: List of license data (strings or dicts)
+        lifecycle_phase: CISA 2025 Generation Context (build, post-build, operations, etc.)
+        source: Name of the provider that supplied this metadata
+
+        VCS fields (added by CI providers or sbomify.json config):
+        vcs_url: Repository URL (e.g., https://github.com/owner/repo)
+        vcs_commit_sha: Full commit SHA
+        vcs_ref: Branch or tag name (e.g., main, refs/heads/main, v1.0.0)
+        vcs_commit_url: URL to the specific commit
+    """
+
+    supplier: Optional[Dict[str, Any]] = None
+    manufacturer: Optional[Dict[str, Any]] = None
+    authors: Optional[List[Dict[str, Any]]] = None
+    licenses: Optional[List[Any]] = None
+    lifecycle_phase: Optional[str] = None
+    source: Optional[str] = None
+
+    # VCS fields for CI environment enrichment
+    vcs_url: Optional[str] = None
+    vcs_commit_sha: Optional[str] = None
+    vcs_ref: Optional[str] = None
+    vcs_commit_url: Optional[str] = None
+
+    # Additional fields that may be added in the future
+    _extra: Dict[str, Any] = field(default_factory=dict)
+
+    def has_data(self) -> bool:
+        """Check if this metadata contains any meaningful data."""
+        return any(
+            [
+                self.supplier,
+                self.manufacturer,
+                self.authors,
+                self.licenses,
+                self.lifecycle_phase,
+                self.vcs_url,
+                self.vcs_commit_sha,
+                self.vcs_ref,
+                self.vcs_commit_url,
+            ]
+        )
+
+    def merge(self, other: "AugmentationMetadata") -> "AugmentationMetadata":
+        """
+        Merge another metadata instance into this one.
+
+        The current instance's values take precedence (are not overwritten).
+        Only missing fields are filled from the other instance.
+
+        Args:
+            other: Another AugmentationMetadata to merge from
+
+        Returns:
+            New AugmentationMetadata with merged values
+        """
+        # Merge sources for attribution
+        sources = []
+        if self.source:
+            sources.append(self.source)
+        if other.source and other.source not in sources:
+            sources.append(other.source)
+        merged_source = ", ".join(sources) if sources else None
+
+        return AugmentationMetadata(
+            supplier=self.supplier if self.supplier else other.supplier,
+            manufacturer=self.manufacturer if self.manufacturer else other.manufacturer,
+            authors=self.authors if self.authors else other.authors,
+            licenses=self.licenses if self.licenses else other.licenses,
+            lifecycle_phase=self.lifecycle_phase if self.lifecycle_phase else other.lifecycle_phase,
+            source=merged_source,
+            # VCS fields
+            vcs_url=self.vcs_url if self.vcs_url else other.vcs_url,
+            vcs_commit_sha=self.vcs_commit_sha if self.vcs_commit_sha else other.vcs_commit_sha,
+            vcs_ref=self.vcs_ref if self.vcs_ref else other.vcs_ref,
+            vcs_commit_url=self.vcs_commit_url if self.vcs_commit_url else other.vcs_commit_url,
+            _extra={**other._extra, **self._extra},  # self takes precedence
+        )
+
+    def to_dict(self) -> Dict[str, Any]:
+        """
+        Convert to dictionary format compatible with existing augmentation functions.
+
+        Returns:
+            Dictionary with augmentation data
+        """
+        result: Dict[str, Any] = {}
+
+        if self.supplier:
+            result["supplier"] = self.supplier
+        if self.manufacturer:
+            result["manufacturer"] = self.manufacturer
+        if self.authors:
+            result["authors"] = self.authors
+        if self.licenses:
+            result["licenses"] = self.licenses
+        if self.lifecycle_phase:
+            result["lifecycle_phase"] = self.lifecycle_phase
+
+        # VCS fields
+        if self.vcs_url:
+            result["vcs_url"] = self.vcs_url
+        if self.vcs_commit_sha:
+            result["vcs_commit_sha"] = self.vcs_commit_sha
+        if self.vcs_ref:
+            result["vcs_ref"] = self.vcs_ref
+        if self.vcs_commit_url:
+            result["vcs_commit_url"] = self.vcs_commit_url
+
+        # Include any extra fields
+        result.update(self._extra)
+
+        return result
+
+    @classmethod
+    def from_dict(cls, data: Dict[str, Any], source: Optional[str] = None) -> "AugmentationMetadata":
+        """
+        Create AugmentationMetadata from a dictionary.
+
+        Args:
+            data: Dictionary with augmentation data
+            source: Name of the source that provided this data
+
+        Returns:
+            New AugmentationMetadata instance
+        """
+        known_keys = {
+            "supplier",
+            "manufacturer",
+            "authors",
+            "licenses",
+            "lifecycle_phase",
+            "vcs_url",
+            "vcs_commit_sha",
+            "vcs_ref",
+            "vcs_commit_url",
+        }
+        extra = {k: v for k, v in data.items() if k not in known_keys}
+
+        return cls(
+            supplier=data.get("supplier"),
+            manufacturer=data.get("manufacturer"),
+            authors=data.get("authors"),
+            licenses=data.get("licenses"),
+            lifecycle_phase=data.get("lifecycle_phase"),
+            source=source,
+            vcs_url=data.get("vcs_url"),
+            vcs_commit_sha=data.get("vcs_commit_sha"),
+            vcs_ref=data.get("vcs_ref"),
+            vcs_commit_url=data.get("vcs_commit_url"),
+            _extra=extra,
+        )

sbomify_action/_augmentation/protocol.py

@@ -0,0 +1,80 @@
+"""AugmentationProvider protocol for SBOM augmentation plugins."""
+
+from typing import Optional, Protocol
+
+from .metadata import AugmentationMetadata
+
+
+class AugmentationProvider(Protocol):
+    """
+    Protocol defining the interface for augmentation provider plugins.
+
+    Each provider implements this protocol to supply organizational metadata
+    for SBOM augmentation (supplier, authors, licenses, lifecycle_phase).
+    Providers have priorities - lower numbers indicate higher priority (tried first).
+
+    Example:
+        class JsonConfigProvider:
+            name = "json-config"
+            priority = 10  # High priority - local config takes precedence
+
+            def fetch(self, component_id: str | None = None, **kwargs) -> Optional[AugmentationMetadata]:
+                # Read from sbomify.json and return metadata
+                ...
+    """
+
+    @property
+    def name(self) -> str:
+        """
+        Human-readable name of this provider.
+
+        Used for logging and tracking which provider supplied metadata.
+        Examples: "json-config", "sbomify-api", "env-vars"
+        """
+        ...
+
+    @property
+    def priority(self) -> int:
+        """
+        Priority of this provider (lower = higher priority).
+
+        When multiple providers are available, they are tried in priority order.
+        Local/static sources should have low priorities (e.g., 10), API sources
+        should have higher priorities (e.g., 50).
+
+        Recommended priority ranges:
+        - 1-20: Local config files (JSON, YAML)
+        - 21-40: Environment variables
+        - 41-60: API sources (sbomify API)
+        - 61-100: Fallback sources
+        """
+        ...
+
+    def fetch(
+        self,
+        component_id: Optional[str] = None,
+        api_base_url: Optional[str] = None,
+        token: Optional[str] = None,
+        config_path: Optional[str] = None,
+        **kwargs,
+    ) -> Optional[AugmentationMetadata]:
+        """
+        Fetch augmentation metadata from this provider.
+
+        Implementations should:
+        1. Retrieve metadata from their source (file, API, env vars, etc.)
+        2. Return normalized AugmentationMetadata
+        3. Handle errors gracefully (return None on failure)
+        4. Set the 'source' field on the returned metadata
+
+        Args:
+            component_id: Component ID (required for API providers)
+            api_base_url: API base URL (for API providers)
+            token: Authentication token (for API providers)
+            config_path: Path to config file (for file-based providers)
+            **kwargs: Additional provider-specific arguments
+
+        Returns:
+            AugmentationMetadata if successful, None if fetch fails or no data
+        """
+        ...

sbomify_action/_augmentation/providers/__init__.py

@@ -0,0 +1,18 @@
+"""Augmentation providers for fetching organizational metadata."""
+
+# Re-export utility from parent module for backwards compatibility
+from ..utils import is_vcs_augmentation_disabled
+from .bitbucket import BitbucketPipelinesProvider
+from .github import GitHubActionsProvider
+from .gitlab import GitLabCIProvider
+from .json_config import JsonConfigProvider
+from .sbomify_api import SbomifyApiProvider
+
+__all__ = [
+    "BitbucketPipelinesProvider",
+    "GitHubActionsProvider",
+    "GitLabCIProvider",
+    "JsonConfigProvider",
+    "SbomifyApiProvider",
+    "is_vcs_augmentation_disabled",
+]

sbomify_action/_augmentation/providers/bitbucket.py

@@ -0,0 +1,105 @@
+"""Bitbucket Pipelines provider for VCS augmentation metadata.
+
+This provider detects when running in Bitbucket Pipelines and extracts
+VCS information from environment variables. Supports both Bitbucket Cloud
+and attempts best-effort support for Bitbucket Data Center.
+
+Environment variables used (Cloud):
+- BITBUCKET_PIPELINE_UUID: Detection (present when in Bitbucket Pipelines)
+- BITBUCKET_GIT_HTTP_ORIGIN: Repository URL
+- BITBUCKET_COMMIT: Full commit SHA
+- BITBUCKET_BRANCH: Branch name (not set for tags)
+- BITBUCKET_TAG: Tag name (not set for branches)
+- BITBUCKET_WORKSPACE: Workspace name
+- BITBUCKET_REPO_SLUG: Repository slug
+
+For Bitbucket Data Center, environment variables may differ. Use sbomify.json
+to configure VCS URL manually if auto-detection fails.
+
+Set DISABLE_VCS_AUGMENTATION=true to disable VCS enrichment.
+"""
+
+import os
+from typing import Optional
+
+from sbomify_action.logging_config import logger
+
+from ..metadata import AugmentationMetadata
+from ..utils import is_vcs_augmentation_disabled, truncate_sha
+
+
+class BitbucketPipelinesProvider:
+    """
+    Provider that extracts VCS metadata from Bitbucket Pipelines environment.
+
+    This provider has priority 20, which is lower than sbomify.json (10),
+    allowing local config to override auto-detected values.
+    """
+
+    name: str = "bitbucket-pipelines"
+    priority: int = 20
+
+    def fetch(
+        self,
+        component_id: Optional[str] = None,
+        api_base_url: Optional[str] = None,
+        token: Optional[str] = None,
+        config_path: Optional[str] = None,
+        **kwargs,
+    ) -> Optional[AugmentationMetadata]:
+        """
+        Extract VCS metadata from Bitbucket Pipelines environment variables.
+
+        Args:
+            component_id: Ignored (not needed for CI provider)
+            api_base_url: Ignored (not needed for CI provider)
+            token: Ignored (not needed for CI provider)
+            config_path: Ignored (not needed for CI provider)
+            **kwargs: Additional arguments (ignored)
+
+        Returns:
+            AugmentationMetadata with VCS info if in Bitbucket Pipelines, None otherwise
+        """
+        # Check if VCS augmentation is disabled
+        if is_vcs_augmentation_disabled():
+            logger.debug("VCS augmentation disabled, skipping Bitbucket Pipelines provider")
+            return None
+
+        # Check if we're running in Bitbucket Pipelines
+        if not os.getenv("BITBUCKET_PIPELINE_UUID"):
+            return None
+
+        # Extract VCS information
+        # BITBUCKET_GIT_HTTP_ORIGIN contains the full repo URL for Cloud
+        vcs_url = os.getenv("BITBUCKET_GIT_HTTP_ORIGIN")
+        commit_sha = os.getenv("BITBUCKET_COMMIT")
+        # Branch or tag
+        ref = os.getenv("BITBUCKET_BRANCH") or os.getenv("BITBUCKET_TAG")
+
+        # Fallback: try to construct URL from workspace and repo slug
+        if not vcs_url:
+            workspace = os.getenv("BITBUCKET_WORKSPACE")
+            repo_slug = os.getenv("BITBUCKET_REPO_SLUG")
+            if workspace and repo_slug:
+                vcs_url = f"https://bitbucket.org/{workspace}/{repo_slug}"
+                logger.debug("Constructed Bitbucket URL from workspace/repo slug")
+
+        if not vcs_url:
+            logger.warning(
+                "Bitbucket Pipelines detected but could not determine repository URL. "
+                "For Bitbucket Data Center, configure vcs_url in sbomify.json."
+            )
+            return None
+
+        # Construct commit URL
+        vcs_commit_url = f"{vcs_url}/commits/{commit_sha}" if commit_sha else None
+
+        logger.info(f"Detected Bitbucket Pipelines: {vcs_url} @ {truncate_sha(commit_sha)}")
+
+        return AugmentationMetadata(
+            source=self.name,
+            vcs_url=vcs_url,
+            vcs_commit_sha=commit_sha,
+            vcs_ref=ref,
+            vcs_commit_url=vcs_commit_url,
+        )

sbomify_action/_augmentation/providers/github.py

@@ -0,0 +1,97 @@
+"""GitHub Actions provider for VCS augmentation metadata.
+
+This provider detects when running in GitHub Actions and extracts
+VCS information from environment variables. Supports both GitHub.com
+and GitHub Enterprise Server via GITHUB_SERVER_URL.
+
+Environment variables used:
+- GITHUB_ACTIONS: Detection ("true" when in GitHub Actions)
+- GITHUB_SERVER_URL: Server URL (e.g., https://github.com or https://github.mycompany.com)
+- GITHUB_REPOSITORY: Repository in owner/repo format
+- GITHUB_SHA: Full commit SHA
+- GITHUB_REF: Git ref (e.g., refs/heads/main, refs/tags/v1.0.0)
+- GITHUB_REF_NAME: Short ref name (e.g., main, v1.0.0)
+
+Set DISABLE_VCS_AUGMENTATION=true to disable VCS enrichment.
+"""
+
+import os
+from typing import Optional
+
+from sbomify_action.logging_config import logger
+
+from ..metadata import AugmentationMetadata
+from ..utils import is_vcs_augmentation_disabled, truncate_sha
+
+
+class GitHubActionsProvider:
+    """
+    Provider that extracts VCS metadata from GitHub Actions environment.
+
+    This provider has priority 20, which is lower than sbomify.json (10),
+    allowing local config to override auto-detected values.
+    """
+
+    name: str = "github-actions"
+    priority: int = 20
+
+    def fetch(
+        self,
+        component_id: Optional[str] = None,
+        api_base_url: Optional[str] = None,
+        token: Optional[str] = None,
+        config_path: Optional[str] = None,
+        **kwargs,
+    ) -> Optional[AugmentationMetadata]:
+        """
+        Extract VCS metadata from GitHub Actions environment variables.
+
+        Args:
+            component_id: Ignored (not needed for CI provider)
+            api_base_url: Ignored (not needed for CI provider)
+            token: Ignored (not needed for CI provider)
+            config_path: Ignored (not needed for CI provider)
+            **kwargs: Additional arguments (ignored)
+
+        Returns:
+            AugmentationMetadata with VCS info if in GitHub Actions, None otherwise
+        """
+        # Check if VCS augmentation is disabled
+        if is_vcs_augmentation_disabled():
+            logger.debug("VCS augmentation disabled, skipping GitHub Actions provider")
+            return None
+
+        # Check if we're running in GitHub Actions
+        if os.getenv("GITHUB_ACTIONS") != "true":
+            return None
+
+        # Extract VCS information
+        server_url = os.getenv("GITHUB_SERVER_URL", "https://github.com")
+        repository = os.getenv("GITHUB_REPOSITORY")
+        commit_sha = os.getenv("GITHUB_SHA")
+        ref = os.getenv("GITHUB_REF_NAME") or os.getenv("GITHUB_REF")
+
+        if not repository:
+            logger.warning("GitHub Actions detected but GITHUB_REPOSITORY not set")
+            return None
+
+        # Construct URLs
+        vcs_url = f"{server_url}/{repository}"
+        vcs_commit_url = f"{server_url}/{repository}/commit/{commit_sha}" if commit_sha else None
+
+        # Clean up ref (remove refs/heads/ or refs/tags/ prefix if present)
+        if ref:
+            if ref.startswith("refs/heads/"):
+                ref = ref[len("refs/heads/") :]
+            elif ref.startswith("refs/tags/"):
+                ref = ref[len("refs/tags/") :]
+
+        logger.info(f"Detected GitHub Actions: {repository} @ {truncate_sha(commit_sha)}")
+
+        return AugmentationMetadata(
+            source=self.name,
+            vcs_url=vcs_url,
+            vcs_commit_sha=commit_sha,
+            vcs_ref=ref,
+            vcs_commit_url=vcs_commit_url,
+        )