ci (security): SBOM generation

[turbobobbytraykov]

Add on-demand SBOM generation workflow

What

Adds an opt-in GitHub workflow that generates an SPDX 2.2 SBOM for the Infragistics.QueryBuilder.Executor NuGet package using Microsoft's sbom-tool. The SBOM is produced out-of-band — the published package itself is never modified and no SBOM is embedded in it.

Why

• SBOMs are increasingly requested for supply-chain compliance, but embedding them in packages has no industry adoption (Microsoft confirmed they use a separate internal process and do not embed SBOMs in their own packages) and would add build time and package size.
• Generating on demand keeps ci.yml and build-and-publish.yml completely untouched — zero impact on existing workflow performance.

Changes

New: .github/workflows/sbom.yml

• Triggers
  • Adding the generate sbom label to a PR (label must exist in the repo).
  • A published GitHub release.
• sbom job (ubuntu-latest): packs the NuGet package (0.0.0-pr.<PR#> for PRs, the release tag for releases), restores the pinned sbom-tool, generates the SBOM against the packed artifact (-b) with dependency scanning from the repo root (-bc), verifies manifest.spdx.json + .sha256 exist, and uploads two artifacts with 1-day retention:
  • nupkg — the unmodified package the SBOM describes (listed with its hash in the SBOM's files section)
  • sbom-spdx_2.2 — just the _manifest/spdx_2.2 directory
• attach-to-release job (release trigger only): downloads the SBOM artifact, zips it as Infragistics.QueryBuilder.Executor.<tag>.spdx_2.2.zip, and attaches it to the release via gh release upload --clobber.
• Concurrency-grouped per PR/release with cancel-in-progress to avoid duplicate runs from repeated labeling.

New: .config/sbom-tool/dotnet-tools.json

Pins microsoft.sbom.dotnettool 4.1.5 as a dotnet local tool. Design notes:

• Nested manifest (not the root .config/dotnet-tools.json): dotnet tool restore discovery only walks up the directory tree, so the plain dotnet tool restore run by build-and-publish.yml never downloads sbom-tool — verified locally that a root restore restores only the existing tools.
• "rollForward": true is required because the tool targets net8.0 while runners carry newer SDKs only.
• The workflow restores it explicitly with --tool-manifest, and runs it with working-directory: .config/sbom-tool because dotnet tool run has no --tool-manifest option (manifest discovery is cwd-based).

Validation (local)

• Confirmed the CLI does not require a nupkg and packs/scans correctly: sbom-tool generate (v4.1.5, sha256-verified binary) against the build output exited 0 and produced a valid manifest.spdx.json.
• Full workflow command sequence replayed locally: dotnet tool restore --tool-manifest .config/sbom-tool/dotnet-tools.json → tool 4.1.5 restored; dotnet tool run sbom-tool -- generate … from .config/sbom-tool → exit 0, SBOM produced with the nupkg listed in its files section.
• Isolation check: plain root dotnet tool restore does not touch sbom-tool.

Notes for reviewers

• The generate sbom label needs to be created in the repository before the PR trigger can be used.
• rollForward behavior on a runner without the net8 runtime could not be fully simulated locally (net8 is installed here); the first labeled-PR run confirms it.
• Dependabot's nuget ecosystem does not currently update dotnet-tools.json manifests, so sbom-tool version bumps are manual.

[Copilot]

Pull request overview

Adds an opt-in GitHub Actions workflow to generate an SPDX 2.2 SBOM for the Infragistics.QueryBuilder.Executor NuGet package without modifying the published package, and pins sbom-tool as a nested .NET local tool.

Changes:

• Introduces .github/workflows/sbom.yml to pack the package, generate/verify the SBOM, upload artifacts, and (on releases) attach a zipped SBOM to the release.
• Adds a nested .NET tool manifest at .config/sbom-tool/dotnet-tools.json to pin microsoft.sbom.dotnettool v4.1.5 for the workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/sbom.yml	New on-demand SBOM generation + artifact upload + optional release asset attachment workflow.
.config/sbom-tool/dotnet-tools.json	Pins sbom-tool as a nested local tool manifest for isolated restore/use in the SBOM workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.