[DaanHoogland]

Description

Follow-up to #12570.

• Replace sbomify/sbomify-action@master. The action is not on the ASF GitHub Actions allow-list (apache/infrastructure-actions), so the UI and marvin SBOM jobs would not be allowed to run. The SBOMs are now generated with the CycloneDX command-line tools, pinned to a version, in run: steps:
  • UI: @cyclonedx/cyclonedx-npm 6.0.1 from ui/package-lock.json, without dev dependencies (build tooling that is not shipped in the UI bundle). actions/setup-node is added because the tool needs Node 20.18 or later.
  • marvin: cyclonedx-bom 7.5.0 (cyclonedx-py environment) on the venv marvin's dependencies are installed into. This adds license data that the pip freeze list didn't have. The generator runs from its own venv so it doesn't show up in marvin's SBOM.
• Put the CycloneDX Maven plugin in an sbom profile. Until now it was bound to package for every build. It now only runs with -Psbom (or -Dsbom) and is bound to validate. makeAggregateBom resolves the whole reactor from the root before any module is built, so the java-sbom job no longer needs a build: mvn -Dnoredist -Psbom validate writes target/ACS.sbom.{json,xml} in about a minute.

The tag filter [0-9]+.[0-9]+.[0-9]+* is unchanged. In GitHub's filter syntax + means one or more of the preceding character, so it matches release tags like 4.22.0.0.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

How Has This Been Tested?

• mvn -B -ntp -Dnoredist -Psbom validate locally: build success, 583 components (154 CloudStack modules, including the noredist ones), 569 with license data. Without -Psbom the plugin is no longer part of the build.
• A two-module test reactor confirmed that the aggregate BOM, bound at the root, includes sibling modules that have not been built or installed, with the correct dependency graph.
• The UI and marvin steps were not run locally. Their options were checked against the documentation of the pinned versions. To be confirmed with a manual run of the generate sboms workflow on this branch.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 20.78%. Comparing base (d63c21b) to head (0002282).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #14570   +/-   ##
=========================================
  Coverage     20.77%   20.78%           
- Complexity    21914    21932   +18     
=========================================
  Files          6496     6496           
  Lines        591629   591656   +27     
  Branches      72590    72592    +2     
=========================================
+ Hits         122915   122965   +50     
+ Misses       455375   455347   -28     
- Partials      13339    13344    +5     

Flag	Coverage Δ
uitests	3.88% <ø> (ø)
unittests	22.09% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🔴 Test Coverage Grade: D — Marginal

Metric	Value
Line coverage	25.89%
Branch coverage	20.22%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

[nvazquez]

Thanks @DaanHoogland - ASF Allowlist Check now passes. Is the Copilot comment relevant or should it be ready for review as it is now?

[DaanHoogland]

Thanks @DaanHoogland - ASF Allowlist Check now passes. Is the Copilot comment relevant or should it be ready for review as it is now?

I don't know yet @nvazquez . It seems like a serious warning (and it is a comment on a sonar warning) , But i have no idea of an alternative yet. /me looking

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[DaanHoogland]

Thanks @DaanHoogland - ASF Allowlist Check now passes. Is the Copilot comment relevant or should it be ready for review as it is now?

I don't know yet @nvazquez . It seems like a serious warning (and it is a comment on a sonar warning) , But i have no idea of an alternative yet. /me looking

should be fixed now @nvazquez

[nvazquez]

@blueorangutan package

[blueorangutan]

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19910

[nvazquez]

LGTM - packaging and CI jobs passing

[nvazquez]

@blueorangutan ui

[blueorangutan]

@nvazquez a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

[blueorangutan]

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/14570 (QA-JID-1011)

[RosiKyu]

@DaanHoogland I ran the "generate sboms" workflow on this branch:
https://github.com/apache/cloudstack/actions/runs/42222775850

ui sbom fails: https://github.com/apache/cloudstack/actions/runs/42222775850/job/127908632825

    npm error invalid: axios@0.21.4
    Error: Process completed with exit code 254.

The new cyclonedx-npm step checks ui/package-lock.json against ui/package.json, and they don't match (axios 0.21.4 vs ^0.31.1).

Can you update the lockfile in this PR so the step passes?

java sbom also fails: https://github.com/apache/cloudstack/actions/runs/42222775850/job/127908633180

Marvin sbom passes.