Conversation
Adds a CreateSbom nuke target that produces a CycloneDX SBOM for Avalonia.BuildServices as EU Cyber Resilience Act evidence, using the shared generator from AvaloniaUI/build-common#4. The SBOM is written to artifacts/sbom and embedded into the .nupkg at _manifest/cyclonedx/bom.cdx.json. The build-common submodule is pinned to the head of AvaloniaUI/build-common#5 for its projectSearchDirs parameter, since this repository keeps its package project under BuildTask/ rather than the src/ layout the merged generator expects. AvaloniaUI.Licensing is IL-merged into the shipped assembly and referenced with PrivateAssets="All", so it is invisible to the shared generator (excluded as a dev dependency, absent from the nuspec, and merged into the primary assembly the content scan skips); it is added to the SBOM explicitly, with the version read from the csproj. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an automated CycloneDX SBOM generation step to the NUKE build so that each shipped Avalonia.BuildServices NuGet package includes an embedded SBOM (and CI also publishes the standalone SBOM) as technical-documentation evidence.
Changes:
- Introduces a
CreateSbomNUKE target that runs after packaging to generate and embed a CycloneDX SBOM. - Adds build-time integration for the CycloneDX tool and shared SBOM generator extensions (via
build-commonsubmodule). - Updates CI to checkout submodules and upload the generated SBOM as a workflow artifact.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| build/Build.cs | Adds CreateSbom target, invokes shared SBOM generator, and post-processes SBOM + embedded copy to include IL-merged AvaloniaUI.Licensing. |
| build/_build.csproj | Downloads CycloneDX tool package and references shared NUKE extensions from build-common. |
| .nuke/build.schema.json | Registers CreateSbom as an executable NUKE target. |
| .gitmodules | Adds build-common as a git submodule. |
| .github/workflows/ci.yml | Enables submodule checkout and uploads standalone SBOM files as CI artifacts. |
If the shared generator ever starts emitting the component itself (e.g. the reference moves off PrivateAssets="All" and licensing lands back in the shipped nuspec), skip the manual addition instead of emitting a duplicate bom-ref, and warn that the step is obsolete. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
CreateSbomnuke target that produces a CycloneDX SBOM for the shippedAvalonia.BuildServicespackage, as EU Cyber Resilience Act technical-documentation evidence. Uses the shared generator merged in AvaloniaUI/build-common#4; see AvaloniaUI/Avalonia.Controls.TreeDataGrid-Accelerate#169 for the pilot.CreateSbomis.TriggeredBy(CreatePackage), so the existing default target generates and embeds the SBOM with no build-command changes. It runs afterRefAssemblyGenerator, so the recorded SHA-512 hashes are those of the binaries actually shipped. The standalone copy lands inartifacts/sbom/and CI uploads it as ansbomworkflow artifact; an identical copy is embedded into the.nupkgat_manifest/cyclonedx/bom.cdx.json.Avalonia.BuildServicesandAvalonia.BuildServices.Collector, whose output is bundled into the package''stools/folder.build-commonsubmodule points at the head of Support repository layouts beyond src/packages in SBOM generation build-common#5 (2272ff9) rather than main, because this repository keeps its package project underBuildTask/and needs that PR''sprojectSearchDirsparameter (same pin as the Xpf companion PR). Bump to the merge commit once Add copilot GDPR review instructions. #5 lands.PrivateAssets="All", so all three of the shared generator''s detection paths miss it — cyclonedx-dotnet excludes it as a dev dependency, it''s absent from the shipped nuspec (the cross-check that rescues it in the other component repos, which use partialPrivateAssets), and the merged bytes live inside the primary assembly the package-content scan deliberately skips. Its code ships regardless, soBuild.csadds it to the SBOM explicitly, reading the version from the csproj''sPackageReferenceso it can''t drift, and rewrites both the standalone file and the embedded copy.Avalonia.BuildServices.<guid>@0.0.0.0— accurate, sinceRefAssemblyGeneratordeliberately randomizes the shipped assemblies'' identities per build; each component carries anavalonia:packagePathproperty identifying the real file, plus a SHA-512 of the shipped bytes.Test plan
AvaloniaUI.Licensing@3.0.0-rc2present with a dependency edge from the root_manifest/cyclonedx/bom.cdx.jsonis byte-identical to the standalone copy andjsonis registered in[Content_Types].xml🤖 Generated with Claude Code