Integrate Native Image SBOM with GitHub's Dependency Submission API

[rudsberg]

Overview

This PR adds support to automatically generate a highly accurate SBOM with Native Image and submit it to GitHub's dependency submission API. That enables a simple integration with all the powerful security tooling that Github provides:

• Vulnerability tracking with GitHub's Dependabot.
• Dependency tracking with GitHub's Dependency Graph. The Dependency Graph shows the union of the submitted SBOM components and what GitHub infers automatically.

The feature is activated with the option native-image-enable-sbom. It requires contents: write permission and for the Dependency Graph feature to be activated (on by default for public repositories). This feature is supported for GraalVM for JDK 24 or above. It cannot be used for earlier versions since the purl SBOM field, which the GitHub API requires, is only available in the upcoming JDK 24 release.

Approach and Testing

The high-level approach for the implementation is the following:

1. run in main.ts calls setUpSBOMSupport which appends --enable-sbom=export to NATIVE_IMAGE_OPTIONS. Effectively, this instructs any subsequent invocation of native-image to generate an SBOM.
2. run in cleanup.ts calls processSBOM which finds the SBOM, maps the content to the format the GitHub API expects, and submits it to the API.

The feature is tested with a mix of unit and integration tests:

• sbom.test.ts runs unit and integration tests. The GitHub API is mocked.
• test.yml is extended with a new job sbom-test which builds a maven project and asserts that an SBOM is created and verifies its contents.

Example

Consider the test project that the job sbom-test uses which defines one Java class with a dependency on org.json. After the job has executed, the GitHub dashboard is populated with vulnerability alerts under Security/Dependabot and the Dependency Graph under Insights/Dependency graph. Here is how the Security/Dependabot page looks like:

A specific vulnerability:

The Insights/Dependency graph includes the org.json component which was part of the SBOM and the dependencies picked up automatically from the manifest files:

[rudsberg]

There is one failing test which is not related to this PR:
build-test / GraalVM (17.0.13, graalvm, ubuntu-latest, true).

[fniephaus]

Thanks for the PR, @rudsberg! Looks very good already. Left a couple of comments and suggestions.

[fniephaus]

LGTM