[build] Generate cross-platform Selenium Manager SBOM and NOTICE by titusfortner · Pull Request #17819 · SeleniumHQ/selenium

titusfortner · 2026-07-24T21:39:53Z

💥 What does this PR do?

Generates two license-compliance artifacts once per release, alongside the Selenium Manager binaries, in a dedicated sbom job in ci-rust.yml (uploaded as an artifact; the release job only gathers and publishes):

selenium-manager.cdx.json — CycloneDX SBOM
selenium-manager-THIRD-PARTY-NOTICES.txt — third-party attribution

cargo resolves the crate closure for every shipped platform in a single invocation, so one SBOM/NOTICE covers all targets (including Windows-only winapi/windows-*). Generating where the binary is built keeps the artifacts in lockstep with what actually ships. Their sha256s are added to latest.json and both files are attached to the selenium_manager_artifacts release.

🔧 Implementation Notes

rust/about.toml pins all six shipped triples so the NOTICE matches the SBOM; rust/about.hbs renders deduplicated attribution.
cargo cyclonedx --target all and cargo-about (no targets filter) each resolve every platform's crates, so winapi/windows-* are included; cargo-about fails the job if any crate's license isn't in the accepted list.
This supersedes the Bazel-native generation attempted in [build] generate and ship cargo-free SBOM and license notices with Selenium Manager #17812, which can only see one platform's crate closure per build.

🤖 AI assistance

AI assisted (complete below)
- Tool(s): Claude Code
- What was generated: cargo-about config/template and the release-job pipeline steps
- I reviewed all AI output and can explain the change

💡 Additional Considerations

Part 1 of 2. Bazel must download these from a release that already contains them, so the download + packaging wiring follows in a second PR once this has published one release. Tool versions (cargo-cyclonedx, cargo-about) are pinned and may need a bump.

🔄 Types of changes

New feature (non-breaking change which adds functionality)

…he Rust release job

qodo-code-review · 2026-07-24T21:41:21Z

PR Summary by Qodo

Generate Selenium Manager SBOM and third-party NOTICE in Rust CI release flow

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Add a dedicated CI job to generate CycloneDX SBOM and third-party notices for releases.
• Publish SBOM/NOTICE alongside binaries and track their sha256s in latest.json.
• Introduce cargo-about config and template to render deduplicated license attributions.

Diagram

graph TD
  T["tests job"] --> B["platform build jobs"] --> A[("CI artifacts") ] --> R["release job"] --> G["GitHub release (artifacts repo)"]
  T --> S["sbom job"] --> A
  R --> L["latest.json sha256s"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Generate SBOM/NOTICE inside the existing release job

➕ Fewer jobs to manage; simpler DAG
➕ No cross-job artifact dependency for compliance outputs
➖ Makes the release job heavier and harder to debug
➖ Less clear separation between build/publish and compliance generation

2. Generate per-target SBOM/NOTICE during each platform build job

➕ SBOM exactly matches each target’s resolved dependency closure
➕ Avoids relying on multi-target resolution support
➖ More artifacts and release assets to manage
➖ Harder to consume downstream (multiple SBOMs/NOTICES to pick from)

3. Bazel-native SBOM generation

➕ Aligned with Bazel as the top-level build system
➕ Potentially reusable across other Bazel targets
➖ Typically limited to the host/selected platform dependency closure per build
➖ More engineering effort to reach equivalent cross-platform coverage

Recommendation: The dedicated SBOM job is the best tradeoff: it keeps compliance generation explicit and isolated, while still producing a single cross-platform SBOM/NOTICE that the release job can publish consistently. Per-target generation improves fidelity but significantly increases operational overhead, and Bazel-native approaches commonly struggle to capture a unified multi-target crate closure.

Files changed (3) +85 / -2

Other (3) +85 / -2

ci-rust.ymlAdd SBOM/NOTICE job and publish artifacts + checksums in release +37/-2

Add SBOM/NOTICE job and publish artifacts + checksums in release

• Introduces a new 'sbom' job that installs cargo-cyclonedx and cargo-about, generates selenium-manager.cdx.json and a THIRD-PARTY-NOTICES file, and uploads them as a CI artifact. Updates the release job to depend on this job, include the new files in the GitHub release assets, and add their sha256s to latest.json.

.github/workflows/ci-rust.yml

about.hbsAdd cargo-about NOTICE rendering template +20/-0

Add cargo-about NOTICE rendering template

• Adds a Handlebars template for cargo-about to render a third-party notice with an overview by license and per-license full text sections including the crates that use each license.

rust/about.hbs

about.tomlAdd cargo-about license allowlist and generation settings +28/-0

Add cargo-about license allowlist and generation settings

• Defines the accepted SPDX license identifiers needed for cargo-about output, ignores dev-dependencies, disables clearlydefined lookups, and includes a workaround for crates with non-SPDX license metadata (e.g., ring).

rust/about.toml

qodo-code-review · 2026-07-24T21:47:00Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Previous review results

Review updated until commit c422d4b ⚖️ Balanced

Results up to commit ced7673 ⚖️ Balanced

No changes from previous review

Results up to commit 919d2ad ⚖️ Balanced

No changes from previous review

qodo-code-review · 2026-07-24T22:02:58Z

Code review by qodo was updated up to the latest commit 919d2ad

qodo-code-review · 2026-07-26T15:22:37Z

Code review by qodo was updated up to the latest commit c422d4b

Copilot

Pull request overview

This PR adds release-time generation of license-compliance artifacts for Selenium Manager (a CycloneDX SBOM and a consolidated third-party NOTICE), produced in CI and attached to the selenium_manager_artifacts release alongside the binaries.

Changes:

Introduces cargo-about configuration (rust/about.toml) and a NOTICE rendering template (rust/about.hbs).
Adds a dedicated sbom job to .github/workflows/ci-rust.yml to generate and upload selenium-manager.cdx.json and selenium-manager-THIRD-PARTY-NOTICES.txt.
Extends the release job to depend on sbom, include SBOM/NOTICE SHA256s in latest.json, and attach both files to the release.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
rust/about.toml	Adds cargo-about license acceptance/config to drive NOTICE generation.
rust/about.hbs	Adds a cargo-about Handlebars template to render a consolidated NOTICE with license texts.
.github/workflows/ci-rust.yml	Adds SBOM/NOTICE generation + upload and includes these artifacts in the release + latest.json hashes.

Comments suppressed due to low confidence (1)

.github/workflows/ci-rust.yml:246

Cargo.toml includes a Windows-only dependency ([target.'cfg(windows)'.dependencies] winapi = ...), but the NOTICE generation here runs cargo about without any target selection. Unless cargo-about is configured to resolve all shipped targets, the generated selenium-manager-THIRD-PARTY-NOTICES.txt can omit target-gated crates (and their attributions), diverging from the SBOM and from the PR's stated goal of a cross-platform NOTICE.

          cargo cyclonedx --format json --all-features --target all
          cargo about generate about.hbs > selenium-manager-THIRD-PARTY-NOTICES.txt

[build] generate cross-platform Selenium Manager SBOM and NOTICE in t…

ced7673

…he Rust release job

titusfortner mentioned this pull request Jul 24, 2026

[build] Download and bundle Selenium Manager SBOM and NOTICE in each package #17820

Merged

2 tasks

selenium-ci added B-build Includes scripting, bazel and CI integrations C-rust Rust code is mostly Selenium Manager B-manager Selenium Manager labels Jul 24, 2026

[build] generate SBOM/NOTICE in a dedicated job, not the release job

919d2ad

titusfortner changed the title ~~[build] Generate cross-platform Selenium Manager SBOM and NOTICE in the release job~~ [build] Generate cross-platform Selenium Manager SBOM and NOTICE Jul 24, 2026

titusfortner marked this pull request as draft July 24, 2026 22:02

titusfortner added 4 commits July 24, 2026 17:09

[build] trim comments to essentials in SBOM config

68ba810

[build] reduce cargo-about config to the minimum

bc16ea4

[build] trim NOTICE header to a single line

73dda39

[build] fix cargo-about config and template after local validation

c422d4b

titusfortner marked this pull request as ready for review July 26, 2026 15:20

titusfortner requested a review from Copilot July 26, 2026 15:51

Copilot started reviewing on behalf of titusfortner July 26, 2026 15:51 View session

Copilot AI reviewed Jul 26, 2026

View reviewed changes

Comment thread .github/workflows/ci-rust.yml

titusfortner merged commit 9adcf75 into SeleniumHQ:trunk Jul 26, 2026
17 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[build] Generate cross-platform Selenium Manager SBOM and NOTICE - #17819

[build] Generate cross-platform Selenium Manager SBOM and NOTICE#17819
titusfortner merged 6 commits into
SeleniumHQ:trunkfrom
titusfortner:c/selenium-manager-sbom-generate

titusfortner commented Jul 24, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Jul 24, 2026

Uh oh!

qodo-code-review Bot commented Jul 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

titusfortner commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💥 What does this PR do?

🔧 Implementation Notes

🤖 AI assistance

💡 Additional Considerations

🔄 Types of changes

Uh oh!

qodo-code-review Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Great, no issues found!

Previous review results

Uh oh!

qodo-code-review Bot commented Jul 24, 2026

Uh oh!

qodo-code-review Bot commented Jul 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

titusfortner commented Jul 24, 2026 •

edited

Loading

qodo-code-review Bot commented Jul 24, 2026 •

edited

Loading

qodo-code-review Bot commented Jul 24, 2026 •

edited

Loading