ci(NODE-7025): New SBOM generation workflow on dependencies change #4807

ekovalets · 2025-11-25T03:27:40Z

Description

Summary of Changes

This PR adds a new GitHub Actions workflow that will be triggered on packages change.
The trigger will generate a new SBOM.json file and if it differs from the project on will create PR.

Notes for Reviewers

Please review if this is going to work for how you handle project branches.

What is the motivation for this change?

SSDLC Improvement Goals

Double check the following

Lint is passing (npm run check:lint)
Self-review completed using the steps outlined here
PR title follows the correct format: type(NODE-xxxx)[!]: description
- Example: feat(NODE-1234)!: rewriting everything in coffeescript
Changes are covered by tests
New TODOs have a related JIRA ticket

.github/actions/sbom-update/action.yml

baileympearson · 2026-01-13T20:59:23Z

.github/actions/setup-sbom/action.yml

@@ -0,0 +1,19 @@
+name: Setup PHP SBOM


This seems like it was a copy-paste from the PHP implementation?

Yeah, I was replicating structure, but missed to update the text in all places. Removed since no setup needed.

baileympearson · 2026-01-13T21:04:48Z

.github/actions/setup/action.yml

+name: Setup Node SBOM
+description: Sets up environment for generating SBOM in Node.js projects
+inputs:
+  working-directory:


This action shouldn't be necessary because:

the shared setup action we use (and which is called in sbom.yml) already configures Node

cyclonedx/cdxgen appears to be unused

Removed as we use npx and direct download

baileympearson · 2026-01-13T21:05:35Z

.github/workflows/sbom.yml

+
+permissions:
+  contents: write
+  pull-requests: write


Suggested change

pull-requests: write

I think we can remove this permission now that we're committing to main, right?

baileympearson · 2026-01-13T21:07:33Z

.github/workflows/sbom.yml

+
+    concurrency:
+      group: sbom-${{ github.ref }}
+      cancel-in-progress: false


Suggested change

cancel-in-progress: false

cancel-in-progress: true

I definitely think we want cancel-in-progress: true (or limit concurrency to 1 execution at a time). Otherwise, it would be last action to finish wins, right?

For this one, I'd keep the false value, since it let job to finish and new job is pending, no parallel execution, and we don't terminate job in a weird state.

Okay, that's fine too. But then we should probably change the group to an identifier that doesn't include the git ref (which would be different for every action that runs, right?)

baileympearson · 2026-01-13T21:08:51Z

.github/workflows/sbom.yml

+      - name: Load version and package info
+        uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3
+        with:
+          npm_package_name: mongodb


Suggested change

- name: Load version and package info

uses: mongodb-labs/drivers-github-tools/node/get_version_info@v3

with:

npm_package_name: mongodb

This shouldn't be necessary

Don't remember why I've added it, but I'll trust you and remove)

baileympearson · 2026-01-13T21:15:01Z

.github/workflows/sbom.yml

+      - name: Generate/Update package-lock.json
+        run: |
+          echo "Resolving dependencies and generating package-lock.json..."
+          npm install --package-lock-only


We've already run npm install above in mongodb-labs/drivers-github-tools/node/setup@v3. Is it necessary to only install from package-lock? If so, we might want to remove the call to the above action.

.github/actions/sbom-update/action.yml

baileympearson · 2026-01-16T20:10:11Z

.github/workflows/sbom.yml

+
+    concurrency:
+      group: sbom-${{ github.ref }}
+      cancel-in-progress: false


Okay, that's fine too. But then we should probably change the group to an identifier that doesn't include the git ref (which would be different for every action that runs, right?)

baileympearson · 2026-01-16T20:12:29Z

.github/actions/sbom-update/action.yml

+runs:
+  using: composite
+  steps:
+    - name: Generate SBOM


Could we move the contents of this action into a standalone script? That's easier to maintain and run locally than a Github action.

baileympearson · 2026-01-16T20:12:55Z

.github/workflows/sbom.yml

+env:
+  SBOM_FILE: "sbom.json"


Suggested change

env:

SBOM_FILE: "sbom.json"

This won't ever change, I think, so we should be able to remove it.

baileympearson · 2026-01-16T20:15:59Z

sbom.json

@@ -1,51 +1,553 @@
 {


I don't see optional dependencies included in the sbom

(any dependency in the peerDependencies section of our package.json is an optional dependency)

ekovalets added 6 commits November 25, 2025 03:20

NODE-7025: New SBOM generation workflow on dependencies change

74b341c

NODE-7025: Using cyclone npm

c32122b

NODE-7025: Shell use fix

46659ee

NODE-7025: Excluding dev dependencies

e5f5aac

NODE-7025: Only looking at package lock

6908e91

NODE-7025: Fix typo

856c1fd

baileympearson requested changes Dec 10, 2025

View reviewed changes

.github/actions/sbom-update/action.yml Show resolved Hide resolved

baileympearson changed the title ~~ci(NODE-7025)!: New SBOM generation workflow on dependencies change~~ ci(NODE-7025): New SBOM generation workflow on dependencies change Dec 11, 2025

ekovalets added 3 commits December 17, 2025 08:31

NODE-7025: Replacing PR creation with auto-commit to main

a603292

NODE-7025: Making SBOM validation more robust

bc0a7fc

NODE-7025: Revert the devDependencies omittion

2ab3d6d

baileympearson requested changes Jan 13, 2026

View reviewed changes

ekovalets and others added 3 commits January 16, 2026 02:18

NODE-7025: Removing unnecessary setup steps

004b014

chore(deps): Update SBOM after dependency changes

a916462

Merge branch 'main' into main

8ec55e8

baileympearson marked this pull request as ready for review January 16, 2026 17:50

baileympearson requested a review from a team as a code owner January 16, 2026 17:50

baileympearson self-assigned this Jan 16, 2026

baileympearson added the Primary Review In Review with primary reviewer, not yet ready for team's eyes label Jan 16, 2026

PavelSafronov reviewed Jan 16, 2026

View reviewed changes

.github/actions/sbom-update/action.yml Show resolved Hide resolved

PavelSafronov reviewed Jan 16, 2026

View reviewed changes

.github/actions/sbom-update/action.yml Show resolved Hide resolved

baileympearson requested changes Jan 16, 2026

View reviewed changes

ci(NODE-7025): New SBOM generation workflow on dependencies change #4807

Are you sure you want to change the base?

ci(NODE-7025): New SBOM generation workflow on dependencies change #4807

Conversation

ekovalets commented Nov 25, 2025

Description

Summary of Changes

Notes for Reviewers

What is the motivation for this change?

Double check the following

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants