ci: Scan release images with syft instead of cdxgen (no-changelog) (#37344)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: shortstacked

.github/WORKFLOWS.md

@@ -692,10 +692,43 @@ Supply chain security ensures artifacts haven't been tampered with. We provide t
 
 ### SBOM
 
-- **Runs on:** release-publish
-- **Format:** CycloneDX JSON
-- **Signing:** GitHub Attestation API
-- **Attached to:** GitHub Release
+There are two, with different subjects and different consumers. They are not duplicates.
+
+| | Release SBOM | Image SBOM |
+|---|---|---|
+| **Job** | `generate-and-attach-sbom` (`sbom-generation-callable.yml`) | `sbom-attestation` (`docker-build-push.yml`) |
+| **Scans** | the deployed npm closure in `compiled/` (`cdxgen -t pnpm`) | each pushed image, by digest (`syft`) |
+| **Covers** | npm only | OS packages **and** npm, as laid down in the image |
+| **Signing** | GitHub Attestation API, subject `./package.json` | `cosign attest`, subject = image digest |
+| **Output** | `sbom-source.cdx.json`, `THIRD_PARTY_LICENSES.md`, `vex.openvex.json` on the GitHub Release | attestation in the registry beside the image |
+| **Consumer** | humans — legal/license compliance; backs `/third-party-licenses` | machines — `cosign verify-attestation`, admission control |
+
+Format is CycloneDX JSON 1.6 for both. Each pipeline pins the schema version, so a
+scanner upgrade cannot change the shape of a signed artifact without a visible diff.
+
+The two use different scanners on purpose. The release SBOM runs `cdxgen -t pnpm` over the
+resolved pnpm closure with `FETCH_LICENSE=true`, because a lockfile scan has no package files
+to read licenses from. The image SBOM runs `syft` over the pushed image, which resolves
+licenses from the LICENSE files on disk and so needs no network at all.
+
+The image job used to run `cdxgen -t docker --profile license-compliance`. That profile sets
+`FETCH_LICENSE=true` and nothing else, so it made one sequential npm registry call per
+component — roughly 3,700 per release, about half the job's runtime. syft resolves the same
+licenses locally in a fraction of the time, and catalogues more of the image besides.
+
+A/B any scanner change against the current output before shipping it. The gate only enforces
+`pkg:npm/`, so a change can silently degrade PyPI or OS license coverage while CI stays green.
+Compare the licenses resolved per component, not just the component counts.
+
+`enrich-sbom.mjs --drop-phantom-npm` removes scan artefacts that would otherwise assert
+components the image does not contain: nested test/fixture `package.json` and `exports`
+subpaths. It reads the component's source path from either scanner's property name (`SrcFile`
+for cdxgen, `syft:location:0:path` for syft) and treats syft's `version: "UNKNOWN"` the same as
+a missing version.
+
+Packages whose license cannot be resolved from disk go in
+`scripts/licenses/license-overrides.json` with a verified `source` citation — the upstream
+LICENSE file, not registry metadata.
 
 ### SLSA L3 Provenance
 

.github/actions/setup-nodejs/action.yml

@@ -73,7 +73,11 @@ runs:
       uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: ${{ inputs.node-version }}
-        cache: 'pnpm'
+        # A job that installs nothing must not participate in the pnpm-store
+        # cache. Its post step would save an empty store, and cache keys are
+        # write-once — so if it lost the race to a real installer, every other
+        # job on that key would restore nothing and silently re-download.
+        cache: ${{ inputs.install-command != '' && 'pnpm' || '' }}
         cache-dependency-path: ${{ inputs.cache-dependency-path }}
 
     # Fail fast if setup-node silently fell through to the runner's baked-in

.github/scripts/attest-image-sbom.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * Per-image SBOM attestation for the release Docker images. For each built image:
- * cdxgen scans it (OS + npm), enrich-sbom resolves licenses, check-sbom-licenses
+ * syft scans it (OS + npm), enrich-sbom resolves licenses, check-sbom-licenses
  * gates the npm components, and the result is attested to the image digest via
  * cosign — the same mechanism as the VEX/provenance attestations.
  *
@@ -11,12 +11,12 @@
  * Usage: node .github/scripts/attest-image-sbom.mjs   (run from the repo root)
  */
 import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = path.resolve(scriptDir, '..', '..');
-const CDXGEN = path.join(scriptDir, 'node_modules', '.bin', 'cdxgen');
 const ENRICH = path.join(REPO_ROOT, 'scripts', 'licenses', 'enrich-sbom.mjs');
 const CHECK = path.join(REPO_ROOT, 'scripts', 'licenses', 'check-sbom-licenses.mjs');
 const ALLOW_REFS = [
@@ -40,35 +40,78 @@ function run(cmd, args, extraEnv) {
 	});
 }
 
+/**
+ * The gate only inspects components it can see, so it passes on an SBOM that
+ * catalogued nothing. Check the shape before signing a near-empty SBOM.
+ */
+export function assertSbomIsUsable(sbomPath, label) {
+	const components = JSON.parse(readFileSync(sbomPath, 'utf-8')).components ?? [];
+	const npm = components.filter((c) => c.purl?.startsWith('pkg:npm/')).length;
+	if (npm === 0) {
+		throw new Error(`${label}: SBOM has no npm components. The scanner catalogued nothing.`);
+	}
+	// Warn rather than block. Downstream scanners want this to pick a distro
+	// vulnerability feed, but it is not a property these bases are known to
+	// hold: the runtime base runs `apk del apk-tools` and the distroless runners
+	// image carries no package manager at all. Blocking on an unverified
+	// assumption would fail every release rather than catch a bad scan.
+	if (!components.some((c) => c.type === 'operating-system')) {
+		console.log(
+			`::warning::${label}: SBOM has no operating-system component, so distro CVE feeds cannot be selected for it.`,
+		);
+	}
+}
+
 function attest({ label, image, digest }) {
 	const ref = `${image}@${digest}`;
 	const out = path.join(REPO_ROOT, `sbom-${label}.cdx.json`);
 	console.log(`::group::SBOM for ${label} (${ref})`);
 
-	// Pull the (host-arch) image and scan its filesystem: OS packages + npm.
-	run('docker', ['pull', ref]);
-	// FETCH_LICENSE=true would make cdxgen call the npm registry for every package
-	// to resolve missing license data. In practice it resolves nothing — packages
-	// without a license field in their tarball also have no license in the registry —
-	// and adds hundreds of sequential HTTP requests. License gaps are covered by
-	// enrich-sbom.mjs (license-overrides.json + first-party detection) below.
-	run(
-		CDXGEN,
-		['-t', 'docker', '--no-install-deps', '--profile', 'license-compliance', '--spec-version', '1.6', '-o', out, ref],
-		{ CDXGEN_NO_BANNER: '1' },
-	);
+	// finally, so a throw still closes the group — otherwise the error that
+	// names the failing image renders inside a collapsed section.
+	try {
+		// Pull the (host-arch) image and scan its filesystem: OS packages + npm.
+		run('docker', ['pull', ref]);
+		// `docker:` pins the scan to the image just pulled. A bare ref lets syft's
+		// own provider order decide, and it may resolve the multi-arch index from
+		// the registry instead — describing a different manifest than the one
+		// cosign then attests to.
+		// syft reads licenses from the LICENSE files on disk, so this scan makes no
+		// registry requests. `-file` excludes its per-file catalogue, ~4000 entries.
+		run('syft', [
+			`docker:${ref}`,
+			'-o',
+			`cyclonedx-json@1.6=${out}`,
+			'--select-catalogers',
+			'-file',
+			'-q',
+		]);
 
-	// Resolve first-party + override licenses (lenient: this image holds only a
-	// subset of the npm closure, so absent overrides are not stale pins) and drop
-	// cdxgen filesystem-scan phantoms.
-	run(process.execPath, [ENRICH, out, '--lenient-config', '--drop-phantom-npm']);
+		// Resolve first-party + override licenses (lenient: this image holds only a
+		// subset of the npm closure, so absent overrides are not stale pins) and drop
+		// scanner filesystem phantoms.
+		run(process.execPath, [ENRICH, out, '--lenient-config', '--drop-phantom-npm']);
 
-	// Release-blocking gate, scoped to npm — OS packages carry upstream-distro
-	// license strings we don't control, so they're inventoried but not gated.
-	run(process.execPath, [CHECK, out, ...ALLOW_REFS, '--enforce-prefix=pkg:npm/']);
+		// Release-blocking gate, scoped to npm — OS packages carry upstream-distro
+		// license strings we don't control, so they're inventoried but not gated.
+		run(process.execPath, [CHECK, out, ...ALLOW_REFS, '--enforce-prefix=pkg:npm/']);
+		assertSbomIsUsable(out, label);
 
-	run('cosign', ['attest', '--yes', '--type', 'cyclonedx', '--predicate', out, ref]);
-	console.log('::endgroup::');
+		// --replace, so re-running after a mid-loop failure does not leave the
+		// digest carrying two CycloneDX attestations.
+		run('cosign', [
+			'attest',
+			'--yes',
+			'--replace',
+			'--type',
+			'cyclonedx',
+			'--predicate',
+			out,
+			ref,
+		]);
+	} finally {
+		console.log('::endgroup::');
+	}
 }
 
 function main() {
@@ -77,7 +120,20 @@ function main() {
 		console.log('No images with digests to attest — skipping.');
 		return;
 	}
-	for (const target of targets) attest(target);
+	// Attempt every image, then report. Aborting on the first failure leaves the
+	// later images silently unattested and hides whether they would have passed.
+	const failed = [];
+	for (const target of targets) {
+		try {
+			attest(target);
+		} catch (err) {
+			failed.push(`${target.label}: ${err.message}`);
+			console.log(`::error title=SBOM attestation::${target.label}: ${err.message}`);
+		}
+	}
+	if (failed.length > 0) {
+		throw new Error(`${failed.length} of ${targets.length} image(s) failed:\n  ${failed.join('\n  ')}`);
+	}
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

.github/scripts/attest-image-sbom.test.mjs

@@ -1,6 +1,9 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { parseTargets } from './attest-image-sbom.mjs';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertSbomIsUsable, parseTargets } from './attest-image-sbom.mjs';
 
 describe('parseTargets', () => {
 	it('builds a target per image when both ref and digest are present', () => {
@@ -35,3 +38,47 @@ describe('parseTargets', () => {
 		assert.deepEqual(parseTargets({}), []);
 	});
 });
+
+describe('assertSbomIsUsable', () => {
+	const tmp = mkdtempSync(path.join(os.tmpdir(), 'sbom-assert-'));
+	const write = (name, components) => {
+		const p = path.join(tmp, name);
+		writeFileSync(p, JSON.stringify({ components }));
+		return p;
+	};
+	const OS = { type: 'operating-system', name: 'alpine', version: '3.24' };
+
+	it('accepts an SBOM with npm components and an operating system', () => {
+		assert.doesNotThrow(() =>
+			assertSbomIsUsable(write('ok.json', [{ purl: 'pkg:npm/a@1' }, OS]), 'n8n'),
+		);
+	});
+
+	it('rejects an SBOM the scanner failed to populate', () => {
+		const p = write('empty.json', [{ purl: 'pkg:apk/alpine/busybox@1.0' }, OS]);
+		assert.throws(() => assertSbomIsUsable(p, 'n8n'), /no npm components/);
+	});
+
+	// Warns rather than throws: the distroless runners image carries no package
+	// manager and the runtime base strips apk-tools, so an absent OS component
+	// is not known to be a fault. Blocking on it would fail every release.
+	it('warns but accepts an SBOM with no operating-system component', () => {
+		const logged = [];
+		const original = console.log;
+		console.log = (msg) => logged.push(String(msg));
+		try {
+			assert.doesNotThrow(() =>
+				assertSbomIsUsable(write('no-os.json', [{ purl: 'pkg:npm/a@1' }]), 'runners'),
+			);
+		} finally {
+			console.log = original;
+		}
+		assert.ok(logged.some((l) => /^::warning::runners: .*no operating-system component/.test(l)));
+	});
+
+	it('names the image in the failure so a four-image run says which one broke', () => {
+		assert.throws(() => assertSbomIsUsable(write('named.json', [OS]), 'runners-distroless'), {
+			message: /^runners-distroless:/,
+		});
+	});
+});

.github/test-metrics/e2e-impact-map.json

@@ -565,6 +565,18 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
 
+      # An empty document still gets signed and attached, and trivy still loads
+      # it — so a statement lost to a typo'd purl or a stale pin degrades to a
+      # silent no-op. Warn rather than fail: empty is a legitimate state when
+      # nothing is currently suppressed.
+      - name: Report VEX statement count
+        run: |
+          COUNT=$(node -e "process.stdout.write(String((require('./security/vex.openvex.json').statements ?? []).length))")
+          echo "VEX statements: $COUNT"
+          if [ "$COUNT" -eq 0 ]; then
+            echo "::warning::VEX document has no statements - every published image will carry an attestation that suppresses nothing."
+          fi
+
       - name: Login to GHCR
         uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
@@ -605,11 +617,11 @@ jobs:
             ${{ needs.create_multi_arch_manifest.outputs.runners_distroless_image }}@${{ needs.create_multi_arch_manifest.outputs.runners_distroless_digest }}
 
   # SBOM Attestation - one enriched, license-gated CycloneDX SBOM per image.
-  # cdxgen scans the image (OS + npm), enrich-sbom resolves first-party + override
-  # licenses, check-sbom-licenses gates the npm components, and the result is
-  # attested to the image digest via cosign (same mechanism as VEX/provenance).
-  # This replaces BuildKit's `sbom: true` so the image carries the same resolved
-  # license picture as the release SBOM rather than the un-enriched syft output.
+  # syft scans the image for OS and npm packages. enrich-sbom resolves first-party
+  # and override licenses. check-sbom-licenses gates the npm components. cosign then
+  # attests the result to the image digest, as it does for VEX and provenance.
+  # The build sets oci-mediatypes on the exporter to get the OCI index format,
+  # so BuildKit emits no SBOM. This job supplies the license data.
   sbom-attestation:
     name: SBOM Attestation
     needs:
@@ -637,13 +649,29 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup Node.js and install SBOM tooling
+      # Nothing to install: syft replaced cdxgen, and the two license scripts have
+      # no dependencies. This step only pins the Node version.
+      - name: Setup Node.js
         uses: ./.github/actions/setup-nodejs
         with:
           build-command: ''
-          install-command: pnpm install --frozen-lockfile --dir ./.github/scripts --ignore-workspace
+          install-command: ''
+          # Scope the cache key: the default is the root lockfile, which would
+          # restore the whole workspace pnpm store into a job that never runs pnpm.
           cache-dependency-path: .github/scripts/pnpm-lock.yaml
 
+      # Pin the scanner, not just the action. cdxgen was pinned in a lockfile;
+      # syft's default version rides the action release, so a SHA bump would
+      # silently change what produces the signed SBOM. enrich-sbom.mjs depends
+      # on two syft specifics — the `syft:location:0:path` property name and the
+      # `UNKNOWN` version sentinel — so re-A/B against a real image when bumping.
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
+        with:
+          # Matches what this action SHA already defaults to, so pinning it
+          # records the current behaviour rather than changing it.
+          syft-version: v1.38.2
+
       - name: Install Cosign
         uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
 

.github/workflows/docker-build-push.yml

@@ -366,5 +366,19 @@ export default defineConfig(
 			'n8n-local-rules/no-dynamic-regexp': 'off',
 		},
 	},
+	{
+		// The CodeMirror TypeScript language service runs in a browser web worker, so
+		// Vite bundles `typescript` and `@typescript/vfs` into it and nothing resolves
+		// them from node_modules at runtime. They stay devDependencies to keep the
+		// ~24MB compiler out of the server image, which installs editor-ui's
+		// production closure via packages/cli.
+		files: ['src/features/shared/editors/plugins/codemirror/typescript/**'],
+		rules: {
+			'import-x/no-extraneous-dependencies': [
+				'error',
+				{ devDependencies: true, optionalDependencies: false },
+			],
+		},
+	},
 	...oxlint.buildFromOxlintConfigFile('./.oxlintrc.json'),
 );

packages/frontend/editor-ui/eslint.config.mjs

@@ -63,7 +63,6 @@
     "@replit/codemirror-indentation-markers": "^6.5.3",
     "@sentry/vue": "catalog:frontend",
     "@types/semver": "catalog:",
-    "@typescript/vfs": "^1.6.0",
     "@vscode/markdown-it-katex": "^1.1.2",
     "@vue-flow/background": "1.3.2",
     "@vue-flow/controls": "1.1.3",
@@ -108,9 +107,7 @@
     "sanitize-html": "catalog:",
     "semver": "catalog:",
     "stream-browserify": "^3.0.0",
-    "stylelint": "catalog:",
     "timeago.js": "^4.0.2",
-    "typescript": "catalog:",
     "uuid": "catalog:",
     "v-code-diff": "^1.13.1",
     "v3-infinite-loading": "^1.2.2",
@@ -162,6 +159,7 @@
     "@types/markdown-it": "catalog:",
     "@types/sanitize-html": "catalog:",
     "@types/uuid": "catalog:",
+    "@typescript/vfs": "^1.6.0",
     "@vitejs/plugin-legacy": "^8.0.0",
     "@vitejs/plugin-vue": "catalog:frontend",
     "@vitest/coverage-v8": "catalog:",
@@ -176,8 +174,9 @@
     "oxlint": "catalog:",
     "oxlint-tsgolint": "catalog:",
     "sass-embedded": "catalog:",
-    "stylelint": "catalog:",
     "storybook": "catalog:storybook",
+    "stylelint": "catalog:",
+    "typescript": "catalog:",
     "unplugin-icons": "catalog:frontend",
     "vite": "catalog:",
     "vite-plugin-node-polyfills": "^0.25.0",