SBOMs for Helmfile, docker-compose and Helm charts

[supersven]

This PR adds comprehensive Software Bill of Materials (SBOM) generation and upload capabilities for Wire Server. The implementation creates CycloneDX-format SBOMs for three deployment methods:

• Helm charts: Extracts images from each chart and generates individual SBOMs
• docker-compose: Scans images from the ephemeral deployment compose file
• Helmfile: Processes the integration test helmfile deployment

The workflow uses syft for SBOM generation, skopeo for Docker schema v1 compatibility, and cyclonedx-cli for validation, with Makefile targets orchestrating the process and uploading to Dependency Track.

Unfortunately, the syft version in nixos-25.11 is broken. Thus, we're resorting to unstable.

The results of a test-run can be seen here: https://deptrack.wire.link/projects/804b3a49-644f-4feb-a0e1-bd8e9126d35c/collectionprojects
It was created with

make sboms HELM_SEMVER=5.28.22
make upload-sboms HELM_SEMVER=0.0.63 DEPENDENCY_TRACK_PROJECT_NAME=sven-sbom-test-2

(In the second command, HELM_SEMVER=0.0.63 is just the version of the project in Dependency Track. I'm using bogus versions there because the namespace fills up quickly.)

Ticket: https://wearezeta.atlassian.net/browse/WPB-20616

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[Copilot]

Pull request overview

Adds tooling to generate CycloneDX SBOMs for deployment artifacts (Helm charts, Helmfile, docker-compose) and upload them to Dependency-Track, wiring required CLI tools into the Nix dev environment and exposing make targets to run the workflow.

Changes:

• Add SBOM generation scripts for Helm charts, Helmfile, and docker-compose, plus shared helpers and a centralized syft runner.
• Add Dependency-Track upload/check scripts and new Makefile targets to generate/validate/upload SBOMs.
• Extend flake/Nix dev shell inputs to include syft and cyclonedx-cli (via unstable nixpkgs for syft).

Reviewed changes

Copilot reviewed 5 out of 14 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
nix/wire-server.nix	Adds syft and cyclonedx-cli to the dev environment.
nix/default.nix	Threads pkgs_unstable through to wire-server.nix.
flake.nix	Introduces nixpkgs-unstable and passes pkgs_unstable into ./nix.
flake.lock	Locks the added nixpkgs-unstable input.
hack/bin/upload-sbom.sh	New script to upload SBOMs to Dependency-Track and manage project hierarchy/metadata.
hack/bin/check-sbom-status.sh	New helper to query Dependency-Track processing status by token.
hack/bin/sbom-common.sh	Shared helpers for SBOM generation (image canonicalization, schema1 handling, validation).
hack/bin/run-syft.sh	Centralizes syft invocation/config for consistent SBOM output.
hack/bin/create-helmfile-sboms.sh	Generates SBOMs for images referenced by rendered Helmfile output.
hack/bin/create-helm-sboms.sh	Generates SBOMs for images discovered via helm template across charts.
hack/bin/create-docker-compose-sboms.sh	Generates SBOMs for images in docker-compose config.
Makefile	Adds SBOM generation/validation/upload targets and a Dependency-Track project name variable.
.gitignore	Ignores tmp/ (used for SBOM outputs).
changelog.d/5-internal/sboms	Changelog entry for SBOM tooling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Adds end-to-end SBOM generation (CycloneDX JSON via syft) for Wire Server images across Helm charts, docker-compose ephemeral deploy, and helmfile-based integration deploys, plus tooling to validate and upload SBOMs to Dependency-Track.

Changes:

• Add new hack/bin/* scripts to generate SBOMs for Helm charts, docker-compose images, and helmfile-rendered images, plus upload helpers.
• Add Makefile targets to generate, validate (via cyclonedx), and upload all SBOMs.
• Extend Nix flake/dev environment to include syft (from nixpkgs-unstable) and cyclonedx-cli.

Reviewed changes

Copilot reviewed 5 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
nix/wire-server.nix	Adds pkgs_unstable.syft and cyclonedx-cli into the dev environment inputs.
nix/default.nix	Threads pkgs_unstable into the nix package set import chain.
flake.nix	Adds nixpkgs-unstable input and exposes pkgs_unstable to ./nix.
flake.lock	Locks the new nixpkgs-unstable dependency.
hack/bin/sbom-common.sh	Shared helpers for Docker availability, image canonicalization, schema1 handling, and basic JSON validation.
hack/bin/run-syft.sh	Centralizes syft invocation and environment settings for consistent output.
hack/bin/create-helm-sboms.sh	Generates SBOMs for images discovered via helm template per chart.
hack/bin/create-docker-compose-sboms.sh	Generates SBOMs for images from docker-compose config.
hack/bin/create-helmfile-sboms.sh	Generates SBOMs for images extracted from rendered helmfile templates.
hack/bin/upload-sbom.sh	Uploads a single SBOM to Dependency-Track and fixes parent/external reference relations.
hack/bin/upload-all-sboms.sh	Iterates over generated SBOMs and uploads them by source type.
Makefile	Adds SBOM generation/validation/upload targets (but currently contains unintended corruption in openapi-validate).
.gitignore	Ignores tmp/ where SBOMs are generated.
changelog.d/5-internal/sboms	Changelog entry for SBOM generation/upload.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Adds end-to-end SBOM (CycloneDX) generation and Dependency-Track upload tooling for Wire Server deployments (Helm charts, helmfile, docker-compose), integrating required tooling into the Nix dev environment and exposing Make targets to run the workflow.

Changes:

• Introduces SBOM generation scripts for Helm charts, helmfile-based deployments, and docker-compose deployments (via syft + skopeo schema-v1 handling).
• Adds SBOM upload scripts that create/maintain Dependency-Track project hierarchy and upload SBOMs in bulk.
• Extends Nix flake/dev env to include syft (from nixpkgs-unstable) and cyclonedx-cli, plus Makefile targets and housekeeping (tmp/sboms, .gitignore).

Reviewed changes

Copilot reviewed 6 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
treefmt.toml	Adjusts shellcheck invocation to follow sourced files.
nix/wire-server.nix	Adds syft (unstable) + cyclonedx-cli to the dev environment inputs.
nix/default.nix	Wires pkgs_unstable through to wire-server.nix.
flake.nix	Adds nixpkgs-unstable input and exposes pkgs_unstable to the Nix import chain.
flake.lock	Locks the new nixpkgs-unstable dependency.
hack/bin/sbom-common.sh	Shared helpers for canonicalizing image refs, schema-v1 conversion, and JSON sanity checks.
hack/bin/run-syft.sh	Centralizes syft invocation and standard env configuration.
hack/bin/create-helm-sboms.sh	Generates SBOMs by extracting images from rendered Helm charts.
hack/bin/create-helmfile-sboms.sh	Generates SBOMs by extracting images from helmfile template.
hack/bin/create-docker-compose-sboms.sh	Generates SBOMs from images listed by docker compose config --images.
hack/bin/upload-sbom.sh	Uploads a single SBOM while ensuring Dependency-Track project structure exists and is linked.
hack/bin/upload-all-sboms.sh	Uploads all generated SBOMs under tmp/sboms/*.
Makefile	Adds sboms*, upload-sboms, and validate-sboms targets and cleans tmp/sboms.
.gitignore	Ignores tmp/ where SBOMs are generated.
changelog.d/5-internal/sboms	Documents the internal SBOM feature addition.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.