[build] Generate cross-platform Selenium Manager SBOM and NOTICE

[titusfortner]

💥 What does this PR do?

Generates two license-compliance artifacts once per release, alongside the Selenium Manager binaries, in a dedicated sbom job in ci-rust.yml (uploaded as an artifact; the release job only gathers and publishes):

• selenium-manager.cdx.json — CycloneDX SBOM
• selenium-manager-THIRD-PARTY-NOTICES.txt — third-party attribution

cargo resolves the crate closure for every shipped platform in a single invocation, so one SBOM/NOTICE covers all targets (including Windows-only winapi/windows-*). Generating where the binary is built keeps the artifacts in lockstep with what actually ships. Their sha256s are added to latest.json and both files are attached to the selenium_manager_artifacts release.

🔧 Implementation Notes

• rust/about.toml pins all six shipped triples so the NOTICE matches the SBOM; rust/about.hbs renders deduplicated attribution.
• cargo cyclonedx --target all and cargo-about (no targets filter) each resolve every platform's crates, so winapi/windows-* are included; cargo-about fails the job if any crate's license isn't in the accepted list.
• This supersedes the Bazel-native generation attempted in [build] generate and ship cargo-free SBOM and license notices with Selenium Manager #17812, which can only see one platform's crate closure per build.

🤖 AI assistance

• AI assisted (complete below)
  • Tool(s): Claude Code
  • What was generated: cargo-about config/template and the release-job pipeline steps
  • I reviewed all AI output and can explain the change

💡 Additional Considerations

Part 1 of 2. Bazel must download these from a release that already contains them, so the download + packaging wiring follows in a second PR once this has published one release. Tool versions (cargo-cyclonedx, cargo-about) are pinned and may need a bump.

🔄 Types of changes

• New feature (non-breaking change which adds functionality)

[qodo-code-review]

PR Summary by Qodo

Generate Selenium Manager SBOM and third-party NOTICE in Rust CI release flow

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Add a dedicated CI job to generate CycloneDX SBOM and third-party notices for releases.
• Publish SBOM/NOTICE alongside binaries and track their sha256s in latest.json.
• Introduce cargo-about config and template to render deduplicated license attributions.

Diagram

graph TD
  T["tests job"] --> B["platform build jobs"] --> A[("CI artifacts") ] --> R["release job"] --> G["GitHub release (artifacts repo)"]
  T --> S["sbom job"] --> A
  R --> L["latest.json sha256s"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Generate SBOM/NOTICE inside the existing release job

• ➕ Fewer jobs to manage; simpler DAG
• ➕ No cross-job artifact dependency for compliance outputs
• ➖ Makes the release job heavier and harder to debug
• ➖ Less clear separation between build/publish and compliance generation

2. Generate per-target SBOM/NOTICE during each platform build job

• ➕ SBOM exactly matches each target’s resolved dependency closure
• ➕ Avoids relying on multi-target resolution support
• ➖ More artifacts and release assets to manage
• ➖ Harder to consume downstream (multiple SBOMs/NOTICES to pick from)

3. Bazel-native SBOM generation

• ➕ Aligned with Bazel as the top-level build system
• ➕ Potentially reusable across other Bazel targets
• ➖ Typically limited to the host/selected platform dependency closure per build
• ➖ More engineering effort to reach equivalent cross-platform coverage

Recommendation: The dedicated SBOM job is the best tradeoff: it keeps compliance generation explicit and isolated, while still producing a single cross-platform SBOM/NOTICE that the release job can publish consistently. Per-target generation improves fidelity but significantly increases operational overhead, and Bazel-native approaches commonly struggle to capture a unified multi-target crate closure.

Files changed (3) +85 / -2

Other (3) +85 / -2

ci-rust.ymlAdd SBOM/NOTICE job and publish artifacts + checksums in release +37/-2

Add SBOM/NOTICE job and publish artifacts + checksums in release

• Introduces a new 'sbom' job that installs cargo-cyclonedx and cargo-about, generates selenium-manager.cdx.json and a THIRD-PARTY-NOTICES file, and uploads them as a CI artifact. Updates the release job to depend on this job, include the new files in the GitHub release assets, and add their sha256s to latest.json.

.github/workflows/ci-rust.yml

about.hbsAdd cargo-about NOTICE rendering template +20/-0

Add cargo-about NOTICE rendering template

• Adds a Handlebars template for cargo-about to render a third-party notice with an overview by license and per-license full text sections including the crates that use each license.

rust/about.hbs

about.tomlAdd cargo-about license allowlist and generation settings +28/-0

Add cargo-about license allowlist and generation settings

• Defines the accepted SPDX license identifiers needed for cargo-about output, ignores dev-dependencies, disables clearlydefined lookups, and includes a workaround for crates with non-SPDX license metadata (e.g., ring).

rust/about.toml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Previous review results

Review updated until commit c422d4b ⚖️ Balanced

Results up to commit ced7673 ⚖️ Balanced

No changes from previous review

Results up to commit 919d2ad ⚖️ Balanced

No changes from previous review

[qodo-code-review]

Code review by qodo was updated up to the latest commit 919d2ad

[qodo-code-review]

Code review by qodo was updated up to the latest commit c422d4b

[Copilot]

Pull request overview

This PR adds release-time generation of license-compliance artifacts for Selenium Manager (a CycloneDX SBOM and a consolidated third-party NOTICE), produced in CI and attached to the selenium_manager_artifacts release alongside the binaries.

Changes:

• Introduces cargo-about configuration (rust/about.toml) and a NOTICE rendering template (rust/about.hbs).
• Adds a dedicated sbom job to .github/workflows/ci-rust.yml to generate and upload selenium-manager.cdx.json and selenium-manager-THIRD-PARTY-NOTICES.txt.
• Extends the release job to depend on sbom, include SBOM/NOTICE SHA256s in latest.json, and attach both files to the release.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
rust/about.toml	Adds cargo-about license acceptance/config to drive NOTICE generation.
rust/about.hbs	Adds a cargo-about Handlebars template to render a consolidated NOTICE with license texts.
.github/workflows/ci-rust.yml	Adds SBOM/NOTICE generation + upload and includes these artifacts in the release + latest.json hashes.

Comments suppressed due to low confidence (1)

.github/workflows/ci-rust.yml:246

• Cargo.toml includes a Windows-only dependency ([target.'cfg(windows)'.dependencies] winapi = ...), but the NOTICE generation here runs cargo about without any target selection. Unless cargo-about is configured to resolve all shipped targets, the generated selenium-manager-THIRD-PARTY-NOTICES.txt can omit target-gated crates (and their attributions), diverging from the SBOM and from the PR's stated goal of a cross-platform NOTICE.

          cargo cyclonedx --format json --all-features --target all
          cargo about generate about.hbs > selenium-manager-THIRD-PARTY-NOTICES.txt