Generate SBOM on release

[martinkuba]

Which problem is this PR solving?

This adds a Github workflow that generates an SBOM file using the Github dependency graph. SBOMs are useful for users to detect vulnerabilities in packages including their dependencies.

An example SBOM file generated by this workflow is available here.

[codecov]

Codecov Report

Merging #4479 (49624af) into main (44b0b29) will decrease coverage by 0.14%.
Report is 4 commits behind head on main.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4479      +/-   ##
==========================================
- Coverage   92.55%   92.41%   -0.14%     
==========================================
  Files         315      330      +15     
  Lines        9375     9520     +145     
  Branches     2013     2031      +18     
==========================================
+ Hits         8677     8798     +121     
- Misses        698      722      +24     

see 17 files with indirect coverage changes

[pichlermarc]

Looks good, thanks 🙂

Notes from the SIG Meeting (Feb 21, 2023):

As discussed in the SIG meeting, once the npm sbom issue is sorted out, I'd be great to use it instead. For now this is better than not having it 👍

We talked about how npm sbom does not work for this repo due to it being a monorepo, @martinkuba would you mind adding the link to the issue you opened on NPM for future reference? 🙁

[trentm]

FWIW, I think I was able to get it working with npm sbom ....
See https://gist.github.com/trentm/b2e7c51bede8075827559468e6bb6bfa

npm sbom --sbom-format=spdx --omit=dev --workspaces --sbom-type=library > otel-js-sbom.spdx

I am very ignorant about SBOM's however, so I don't know if this is a valid result.

[pichlermarc]

FWIW, I think I was able to get it working with npm sbom .... See https://gist.github.com/trentm/b2e7c51bede8075827559468e6bb6bfa

npm sbom --sbom-format=spdx --omit=dev --workspaces --sbom-type=library > otel-js-sbom.spdx

I am very ignorant about SBOM's however, so I don't know if this is a valid result.

Ah, interesting. IIRC Martin mentioned that this approach was missing some dependencies. @martinkuba would you mind taking a look if the output has the same issues that you saw when you tested it?

[martinkuba]

The ideal output, IMO, would be the following:

• multiple SBOM files, one for each package (combined in a single zip file)
• no dev dependencies included

This would allow users to only look at SBOM files of packages that they actually use. And since dev dependencies are not installed, there would be no false positives for vulnerabilities or licenses of packages that don't actually get installed.

I have tested npm sbom, the Github API, and Syft. Only npm sbom has options to exclude dev dependencies and generate SBOM with workspaces. Unfortunately, when validating the output, I have found that there were some packages and relationships missing in the npm sbom output.

Here is the issue that I created for NPM CLI: npm/cli#7204

For example, the output of this command is missing the dependency of @opentelemetry/core on @opentelemetry/semantic-conventions (in the relationships section):
npm sbom --sbom-format spdx --omit dev --workspace packages/opentelemetry-core > sbom.json

With that said, I have done some more testing since then and found that the output is fine without the --omit dev. All packages and relationships are there. The downside is that all dev dependencies are included. But they are included in the Github output as well. I am now inclined to change this PR to use npm sbom after all since:

1. npm includes relationships while Github does not
2. npm captures licenses while Github does not

[pichlermarc]

With that said, I have done some more testing since then and found that the output is fine without the --omit dev. All packages and relationships are there. The downside is that all dev dependencies are included. But they are included in the Github output as well. I am now inclined to change this PR to use npm sbom after all since:

1. npm includes relationships while Github does not

2. npm captures licenses while Github does not

Switching over to use npm sbom without --omit dev sounds like a good way forward 👍
Another upside: this way we won't have to use a third-party action to generate it. 🙂

[martinkuba]

I am closing this PR and will open another one that uses npm sbom.