From 1ae008ecd51cd7b4d3047863d613640d2bbecd64 Mon Sep 17 00:00:00 2001
From: Daan Hoogland <dahn@apache.org>
Date: Tue, 3 Nov 2026 15:02:11 +0100
Subject: [PATCH 1/2] sbom: replace non-allow-listed sbomify action, move
 CycloneDX plugin into an sbom profile

---
 .github/workflows/sbom.yml | 33 +++++++++---------
 pom.xml                    | 68 +++++++++++++++++++++++---------------
 2 files changed, 56 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index d368c0e4e313..e23181540616 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -35,15 +35,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+
       - name: Generate UI SBOM
-        uses: sbomify/sbomify-action@master
-        env:
-          LOCK_FILE: ui/package-lock.json
-          OUTPUT_FILE: sbom.ui.cdx.json
-          COMPONENT_NAME: cloudstack-ui
-          COMPONENT_VERSION: ${{ github.ref_name }}
-          UPLOAD: false
-          ENRICH: true
+        # dev dependencies are build tooling and are not shipped in the UI bundle
+        run: |
+          npx --yes @cyclonedx/cyclonedx-npm@6.0.1 --package-lock-only --omit dev \
+            --spec-version 1.6 --output-format JSON --output-file sbom.ui.cdx.json ui/package.json
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -62,7 +62,7 @@ jobs:
         uses: ./.github/actions/setup-env
 
       - name: Generate Java SBOM
-        run: mvn -B -ntp -Dnoredist org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
+        run: mvn -B -ntp -Dnoredist -Psbom validate
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -100,17 +100,14 @@ jobs:
           " > marvin-install-requires.txt
           python3 -m venv marvin-venv
           marvin-venv/bin/pip install --quiet -r marvin-install-requires.txt
-          marvin-venv/bin/pip freeze > marvin-requirements.txt
 
       - name: Generate marvin SBOM
-        uses: sbomify/sbomify-action@master
-        env:
-          LOCK_FILE: marvin-requirements.txt
-          OUTPUT_FILE: sbom.marvin.cdx.json
-          COMPONENT_NAME: cloudstack-marvin
-          COMPONENT_VERSION: ${{ github.ref_name }}
-          UPLOAD: false
-          ENRICH: true
+        # the generator gets its own venv so it doesn't end up in marvin's SBOM
+        run: |
+          python3 -m venv sbom-venv
+          sbom-venv/bin/pip install --quiet cyclonedx-bom==7.5.0
+          sbom-venv/bin/cyclonedx-py environment --spec-version 1.6 --output-format JSON \
+            --output-file sbom.marvin.cdx.json marvin-venv/bin/python
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
diff --git a/pom.xml b/pom.xml
index fb0f593ad58c..e6bae4c98515 100644
--- a/pom.xml
+++ b/pom.xml
@@ -877,33 +877,6 @@
                     </execution>
                 </executions>
             </plugin>
-            <plugin>
-                <groupId>org.cyclonedx</groupId>
-                <artifactId>cyclonedx-maven-plugin</artifactId>
-                <version>2.9.1</version>
-                <executions>
-                    <execution>
-                        <phase>package</phase>
-                        <inherited>false</inherited>
-                        <goals>
-                            <goal>makeAggregateBom</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <projectType>application</projectType>
-                    <schemaVersion>1.6</schemaVersion>
-                    <includeBomSerialNumber>true</includeBomSerialNumber>
-                    <includeCompileScope>true</includeCompileScope>
-                    <includeProvidedScope>true</includeProvidedScope>
-                    <includeRuntimeScope>true</includeRuntimeScope>
-                    <includeSystemScope>true</includeSystemScope>
-                    <includeTestScope>false</includeTestScope>
-                    <includeLicenseText>false</includeLicenseText>
-                    <outputFormat>all</outputFormat>
-                    <outputName>ACS.sbom</outputName>
-                </configuration>
-            </plugin>
         </plugins>
         <pluginManagement>
             <plugins>
@@ -1316,6 +1289,47 @@
                 <module>systemvm</module>
             </modules>
         </profile>
+        <profile>
+            <!-- Writes target/ACS.sbom.{json,xml}: mvn -Psbom validate (add -Dnoredist to include those modules).
+                 makeAggregateBom resolves the whole reactor from the root, so no modules need to be built first. -->
+            <id>sbom</id>
+            <activation>
+                <property>
+                    <name>sbom</name>
+                </property>
+            </activation>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.cyclonedx</groupId>
+                        <artifactId>cyclonedx-maven-plugin</artifactId>
+                        <version>2.9.1</version>
+                        <executions>
+                            <execution>
+                                <phase>validate</phase>
+                                <inherited>false</inherited>
+                                <goals>
+                                    <goal>makeAggregateBom</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                        <configuration>
+                            <projectType>application</projectType>
+                            <schemaVersion>1.6</schemaVersion>
+                            <includeBomSerialNumber>true</includeBomSerialNumber>
+                            <includeCompileScope>true</includeCompileScope>
+                            <includeProvidedScope>true</includeProvidedScope>
+                            <includeRuntimeScope>true</includeRuntimeScope>
+                            <includeSystemScope>true</includeSystemScope>
+                            <includeTestScope>false</includeTestScope>
+                            <includeLicenseText>false</includeLicenseText>
+                            <outputFormat>all</outputFormat>
+                            <outputName>ACS.sbom</outputName>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
         <profile>
             <id>eclipse</id>
             <properties>

From 0002282f8a98e22769024c181c4bf04ee05c1ebd Mon Sep 17 00:00:00 2001
From: Daan Hoogland <dahn@apache.org>
Date: Thu, 5 Nov 2026 16:21:12 +0100
Subject: [PATCH 2/2] ci: install sbom generator without install script
 execution

---
 .github/workflows/sbom.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index e23181540616..57b0b1cec272 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -40,9 +40,12 @@ jobs:
           node-version: 24
 
       - name: Generate UI SBOM
+        # the generator is installed outside the checkout without lifecycle scripts;
         # dev dependencies are build tooling and are not shipped in the UI bundle
         run: |
-          npx --yes @cyclonedx/cyclonedx-npm@6.0.1 --package-lock-only --omit dev \
+          npm install --no-save --no-audit --no-fund --ignore-scripts \
+            --prefix "$RUNNER_TEMP/cdx" @cyclonedx/cyclonedx-npm@6.0.1
+          "$RUNNER_TEMP/cdx/node_modules/.bin/cyclonedx-npm" --package-lock-only --omit dev \
             --spec-version 1.6 --output-format JSON --output-file sbom.ui.cdx.json ui/package.json
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1