Automate SBOM generation for all CI images

ci-conda.Dockerfile

@@ -5,9 +5,25 @@ ARG CUDA_VER=notset
 ARG LINUX_VER=notset
 ARG PYTHON_VER=notset
 ARG MINIFORGE_VER=notset
+ARG SYFT_VER=1.32.0
+
+# syft-base image to generate SBOM
+FROM --platform=$BUILDPLATFORM alpine:3.20 AS syft-base
+ARG BUILDPLATFORM
+ARG SYFT_VER
+
+RUN apk add --no-cache curl tar ca-certificates \
+ && case "$BUILDPLATFORM" in \
+      linux/amd64) SYFT_ARCH="linux_amd64" ;; \
+      linux/arm64) SYFT_ARCH="linux_arm64" ;; \
+      *) echo "Unsupported BUILDPLATFORM: ${BUILDPLATFORM}" && exit 1 ;; \
+    esac \
+ && curl -sSfL "https://github.com/anchore/syft/releases/download/v${SYFT_VER}/syft_${SYFT_VER}_${SYFT_ARCH}.tar.gz" \
+    | tar -xz -C /usr/local/bin syft \
+ && chmod +x /usr/local/bin/syft
 
 FROM condaforge/miniforge3:${MINIFORGE_VER} AS miniforge-upstream
-FROM nvidia/cuda:${CUDA_VER}-base-${LINUX_VER} AS miniforge-cuda
+FROM nvidia/cuda:${CUDA_VER}-base-${LINUX_VER} AS miniforge-cuda-base
 
 ARG CUDA_VER
 ARG LINUX_VER
@@ -144,7 +160,23 @@ case "${LINUX_VER}" in
 esac
 EOF
 
-FROM miniforge-cuda
+# Generate SBOM for the miniforge-cuda stage
+FROM syft-base AS miniforge-cuda-sbom
+SHELL ["/bin/sh", "-euo", "pipefail", "-c"]
+
+RUN --mount=type=bind,from=miniforge-cuda-base,source=/,target=/rootfs,ro \
+    mkdir -p /out && \
+    syft scan \
+      --source-name "rapidsai/miniforge-cuda" \
+      --scope all-layers \
+      --output [email protected]=/out/sbom.json \
+      dir:/rootfs
+
+FROM miniforge-cuda-base AS miniforge-cuda
+RUN mkdir -p /sbom
+COPY --from=miniforge-cuda-sbom /out/sbom.json /sbom/sbom.json
+
+FROM miniforge-cuda AS ci-conda-base
 
 ARG TARGETPLATFORM=notset
 ARG CUDA_VER=notset
@@ -289,4 +321,20 @@ RUN /opt/conda/bin/git config --system --add safe.directory '*'
 # Add pip.conf
 COPY pip.conf /etc/xdg/pip/pip.conf
 
+# Generate SBOM for the ci-conda stage
+FROM syft-base AS ci-conda-sbom
+SHELL ["/bin/sh", "-euo", "pipefail", "-c"]
+
+RUN --mount=type=bind,from=ci-conda-base,source=/,target=/rootfs,ro \
+    mkdir -p /out && \
+    syft scan \
+      --source-name "rapidsai/ci-conda" \
+      --scope all-layers \
+      --output [email protected]=/out/sbom.json \
+      dir:/rootfs
+
+FROM ci-conda-base AS ci-conda
+RUN mkdir -p /sbom
+COPY --from=ci-conda-sbom /out/sbom.json /sbom/sbom.json
+
 CMD ["/bin/bash"]

ci-wheel.Dockerfile

@@ -3,10 +3,25 @@
 
 ARG CUDA_VER=notset
 ARG LINUX_VER=notset
-
+ARG SYFT_VER=1.32.0
 ARG BASE_IMAGE=nvidia/cuda:${CUDA_VER}-devel-${LINUX_VER}
 
-FROM ${BASE_IMAGE}
+# syft-base image to generate SBOM
+FROM --platform=$BUILDPLATFORM alpine:3.20 AS syft-base
+ARG BUILDPLATFORM
+ARG SYFT_VER
+
+RUN apk add --no-cache curl tar ca-certificates \
+ && case "$BUILDPLATFORM" in \
+      linux/amd64) SYFT_ARCH="linux_amd64" ;; \
+      linux/arm64) SYFT_ARCH="linux_arm64" ;; \
+      *) echo "Unsupported BUILDPLATFORM: ${BUILDPLATFORM}" && exit 1 ;; \
+    esac \
+ && curl -sSfL "https://github.com/anchore/syft/releases/download/v${SYFT_VER}/syft_${SYFT_VER}_${SYFT_ARCH}.tar.gz" \
+    | tar -xz -C /usr/local/bin syft \
+ && chmod +x /usr/local/bin/syft
+
+FROM ${BASE_IMAGE} AS ci-wheel-base
 
 ARG CUDA_VER=notset
 ARG LINUX_VER=notset
@@ -266,4 +281,20 @@ RUN git config --system --add safe.directory '*'
 # Add pip.conf
 COPY pip.conf /etc/xdg/pip/pip.conf
 
+# Generate SBOM for the ci-wheel image
+FROM syft-base AS ci-wheel-sbom
+SHELL ["/bin/sh", "-euo", "pipefail", "-c"]
+
+RUN --mount=type=bind,from=ci-wheel-base,source=/,target=/rootfs,ro \
+    mkdir -p /out && \
+    syft scan \
+      --source-name "rapidsai/ci-wheel" \
+      --scope all-layers \
+      --output [email protected]=/out/sbom.json \
+      dir:/rootfs
+
+FROM ci-wheel-base AS ci-wheel
+RUN mkdir -p /sbom
+COPY --from=ci-wheel-sbom /out/sbom.json /sbom/sbom.json
+
 CMD ["/bin/bash"]

citestwheel.Dockerfile

@@ -3,10 +3,25 @@
 
 ARG CUDA_VER=notset
 ARG LINUX_VER=notset
-
+ARG SYFT_VER=1.32.0
 ARG BASE_IMAGE=nvidia/cuda:${CUDA_VER}-devel-${LINUX_VER}
 
-FROM ${BASE_IMAGE}
+# syft-base image to generate SBOM
+FROM --platform=$BUILDPLATFORM alpine:3.20 AS syft-base
+ARG BUILDPLATFORM
+ARG SYFT_VER
+
+RUN apk add --no-cache curl tar ca-certificates \
+ && case "$BUILDPLATFORM" in \
+      linux/amd64) SYFT_ARCH="linux_amd64" ;; \
+      linux/arm64) SYFT_ARCH="linux_arm64" ;; \
+      *) echo "Unsupported BUILDPLATFORM: ${BUILDPLATFORM}" && exit 1 ;; \
+    esac \
+ && curl -sSfL "https://github.com/anchore/syft/releases/download/v${SYFT_VER}/syft_${SYFT_VER}_${SYFT_ARCH}.tar.gz" \
+    | tar -xz -C /usr/local/bin syft \
+ && chmod +x /usr/local/bin/syft
+
+FROM ${BASE_IMAGE} AS citestwheel-base
 
 ARG CUDA_VER=notset
 ARG LINUX_VER=notset
@@ -208,4 +223,20 @@ RUN git config --system --add safe.directory '*'
 # Add pip.conf
 COPY pip.conf /etc/xdg/pip/pip.conf
 
+# Generate SBOM for the citestwheel image
+FROM syft-base AS citestwheel-sbom
+SHELL ["/bin/sh", "-euo", "pipefail", "-c"]
+
+RUN --mount=type=bind,from=citestwheel-base,source=/,target=/rootfs,ro \
+    mkdir -p /out && \
+    syft scan \
+      --source-name "rapidsai/citestwheel" \
+      --scope all-layers \
+      --output [email protected]=/out/sbom.json \
+      dir:/rootfs
+
+FROM citestwheel-base AS citestwheel
+RUN mkdir -p /sbom
+COPY --from=citestwheel-sbom /out/sbom.json /sbom/sbom.json
+
 CMD ["/bin/bash"]