Create Software Bill of Material (SBOM) as part of the release

[LaurentGoderre]

Description:

Create an SBOM to include in the release to preserve dependency information.

POC here:
https://github.com/LaurentGoderre/sbom-ci-test
https://github.com/LaurentGoderre/sbom-ci-test/actions/runs/8452612627

Alternative to #22048

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[github-actions]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers

[michalkleiner]

How can we test this? We'd need to merge it and then see what happens on the next release? Or do a draft PR just with the SBOM generation and test that by running the action manually without all the actual release stuff?

[github-actions]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers

[LaurentGoderre]

@michalkleiner I can do a demo on my fork.

[LaurentGoderre]

@michalkleiner I created a release in my fork but the file doesn't make it to the end package

[LaurentGoderre]

@michalkleiner fixed. You can see it in action here: https://github.com/LaurentGoderre/matomo/releases

[michalkleiner]

Thanks for the link @LaurentGoderre.

I'll put the JSON the tool generates here from one of your release archives. I'm not sure if things like github actions should be included, what can be configured, what should or shouldn't be in the SBOM.

Maybe we need to have a discussion with @matomo-org/core-reviewers on this.

matomo.spdx.json

[github-actions]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers

[github-actions]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers