Add project name and version context to SBOM file name

doc/changes/unreleased.md

@@ -1,3 +1,7 @@
 # Unreleased
 
 ## Summary
+
+## Features
+
+* #905: Added SPDX SBOM generation to the `build-and-publish.yml` with the new Nox session `dependency:sbom`

doc/user_guide/features/github_workflows/index.rst

@@ -64,7 +64,9 @@ Maintained by the PTB
      - Description
    * - ``build-and-publish.yml``
      - Workflow call
-     - Packages the distribution and publishes it to PyPi and GitHub.
+     - Packages the distribution and publishes it to PyPI, and creates a GitHub release
+       that includes an SPDX SBOM v2.
+
    * - ``cd.yml``
      - Push with new tag
      - Manages continuous delivery by creating and uploading build artifacts and

exasol/toolbox/nox/_dependencies.py

@@ -2,6 +2,7 @@
 
 import argparse
 import json
+import subprocess
 from pathlib import Path
 
 import nox
@@ -21,6 +22,10 @@
 from exasol.toolbox.util.dependencies.poetry_dependencies import get_dependencies
 from exasol.toolbox.util.dependencies.track_vulnerabilities import DependenciesAudit
 from exasol.toolbox.util.dependencies.update_dependencies import DependencyUpdater
+from exasol.toolbox.util.version import (
+    Version,
+    poetry_command,
+)
 from noxconfig import PROJECT_CONFIG
 
 
@@ -100,3 +105,47 @@ def report_resolved_vulnerabilities(session: Session) -> None:
         current_vulnerabilities=get_vulnerabilities(path),
     )
     print(audit.report_resolved_vulnerabilities())
+
+
+@poetry_command
+def project_name_and_version_from_poetry(
+    working_directory: Path | None = None,
+) -> tuple[str, Version]:
+    """Return the project name and version reported by Poetry."""
+    output = subprocess.run(  # nosec: B603, B607
+        ["poetry", "version", "--no-ansi"],
+        cwd=working_directory,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    project_name, version = output.stdout.strip().rsplit(maxsplit=1)
+    return project_name.replace("-", "_"), Version.from_string(version)
+
+
+@nox.session(name="dependency:sbom", python=False)
+def generate_sbom(session: Session) -> None:
+    """Generate SPDX SBOM for the project dependencies.
+
+    Note: SPDX version 2 is used as no stable Python tool exists yet
+    for generating SPDX version 3.
+    """
+    project_name, version = project_name_and_version_from_poetry(
+        working_directory=PROJECT_CONFIG.root_path
+    )
+    sbom_filename = f"{project_name}-{version}.spdx.json"
+    bom_cdx_json = PROJECT_CONFIG.root_path / "bom.cdx.json"
+    bom_spdx_json = PROJECT_CONFIG.root_path / sbom_filename
+    session.run("cyclonedx-py", "environment", "-o", bom_cdx_json)
+    session.run(
+        "sbomconvert",
+        "-i",
+        bom_cdx_json,
+        "--sbom",
+        "spdx",
+        "--format",
+        "json",
+        "-o",
+        bom_spdx_json,
+    )
+    session.run("test", "-s", bom_spdx_json)

exasol/toolbox/templates/github/workflows/build-and-publish.yml

@@ -31,6 +31,15 @@ jobs:
         id: build-artifacts
         run: poetry build
 
+      - name: Generate SBOM
+        id: generate-sbom
+        run: poetry run -- nox -s dependency:sbom
+      - name: Rename SBOM
+        id: rename-sbom
+        run: |
+          SBOM_NAME=$(poetry version --no-ansi | awk '{gsub(/-/, "_", $1); print $1"-"$2".spdx.json"}')
+          mv bom.spdx.json $SBOM_NAME
+          echo "SBOM_NAME=$SBOM_NAME" >> $GITHUB_ENV
       - name: Publish Release to PyPi
         id: publish-release-to-pypi
         env:
@@ -47,3 +56,4 @@ jobs:
           --title ${GITHUB_REF_NAME}
           --notes-file ./doc/changes/changes_${GITHUB_REF_NAME}.md
           dist/*
+          ${{ env.SBOM_NAME }}