From c3bc02d920678816df637ee975e4aad5fd3ddfea Mon Sep 17 00:00:00 2001 From: Sam Sarette Date: Mon, 28 Sep 2026 16:29:30 -0400 Subject: [PATCH 1/2] Add GetClangVersion and AddClangPackage workflows Implements #45: adds Clang/LLVM version-discovery and SPDX package workflows mirroring the existing GCC pair, with a configurable path parameter to support vendor distributions such as Arm Toolchain for Embedded. Updates README, user guide, and requirements traceability. --- .cspell.json | 1 + AddClangPackage.yaml | 42 +++++++++++++++++++ GetClangVersion.yaml | 27 ++++++++++++ README.md | 10 +++-- docs/guide/guide.md | 23 ++++++++++ requirements.yaml | 13 ++++++ .../AddClangPackage.cs | 37 ++++++++++++++++ .../GetClangVersion.cs | 24 +++++++++++ 8 files changed, 174 insertions(+), 3 deletions(-) create mode 100644 AddClangPackage.yaml create mode 100644 GetClangVersion.yaml create mode 100644 test/DemaConsulting.SpdxWorkflows.Tests/AddClangPackage.cs create mode 100644 test/DemaConsulting.SpdxWorkflows.Tests/GetClangVersion.cs diff --git a/.cspell.json b/.cspell.json index b034d80..8941f4b 100644 --- a/.cspell.json +++ b/.cspell.json @@ -33,6 +33,7 @@ "LINQ", "libgcj", "libstdc", + "llvmorg", "maintainer", "markdownlint", "mermaid", diff --git a/AddClangPackage.yaml b/AddClangPackage.yaml new file mode 100644 index 0000000..bf3438a --- /dev/null +++ b/AddClangPackage.yaml @@ -0,0 +1,42 @@ +# AddClangPackage +# +# This SpdxTool workflow file adds a Clang/LLVM package entry to an SPDX +# document. The Clang/LLVM package information was attained from: +# - https://clang.llvm.org/ +# - https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT +# +# Parameters: +# - spdx # SPDX document file name +# - id # Clang Package ID +# - version # Clang Package version +# +# Outputs: +# none + +parameters: + spdx: '' + version: '' + id: 'SPDXRef-Package-Clang' + + +steps: + + # Add the Clang package + - command: add-package + inputs: + spdx: ${{ spdx }} + package: + id: ${{ id }} + name: Clang + download: NOASSERTION + license: 'Apache-2.0 WITH LLVM-exception' + copyright: 'Copyright (c) LLVM Project contributors' + version: ${{ version }} + supplier: 'Organization: LLVM Project' + originator: 'Organization: LLVM Project' + homepage: https://clang.llvm.org/ + summary: >- + Clang is a C, C++, Objective-C, and Objective-C++ compiler front end built on the + LLVM compiler infrastructure, commonly used for cross-compiling embedded targets. + purl: pkg:github/llvm/llvm-project@llvmorg-${{ version }} + relationships: [] diff --git a/GetClangVersion.yaml b/GetClangVersion.yaml new file mode 100644 index 0000000..08bcac3 --- /dev/null +++ b/GetClangVersion.yaml @@ -0,0 +1,27 @@ +# GetClangVersion +# +# This SpdxTool workflow file gets the version of the clang compiler. By +# default this runs 'clang' from the system path, but the 'path' parameter +# can be set to the full path of a vendor distribution binary (e.g. the Arm +# Toolchain for Embedded 'clang' executable). +# +# Parameters: +# path: # Clang program name or full path (default 'clang') +# +# Outputs: +# - version # Version of the clang compiler + +parameters: + path: 'clang' + + +steps: + + # Query the version of clang + - command: query + inputs: + output: version + pattern: 'clang version (?\S+)' + program: '${{ path }}' + arguments: + - '--version' diff --git a/README.md b/README.md index 8799e61..c134458 100644 --- a/README.md +++ b/README.md @@ -15,9 +15,9 @@ materials (SBOMs). This collection provides: - **Version Discovery Workflows**: Detect and capture the installed versions of common build - tools — .NET SDK, GCC, MSBuild, NuGet, VSTest, and IAR EW ARM -- **SPDX Package Workflows**: Add build-tool packages to an SPDX document — .NET SDK, GCC, - MSBuild, NuGet, VSTest, and IAR EW ARM + tools — .NET SDK, Clang, GCC, MSBuild, NuGet, VSTest, and IAR EW ARM +- **SPDX Package Workflows**: Add build-tool packages to an SPDX document — .NET SDK, Clang, + GCC, MSBuild, NuGet, VSTest, and IAR EW ARM - **NuGet SPDX Enhancement**: Enrich an SPDX document package with metadata sourced from a NuGet package's own SPDX document - **Multi-Platform Support**: Workflows target Windows and Linux build environments @@ -64,6 +64,7 @@ discovery workflows produce a single `version` output parameter. | Workflow | Description | Platform | | --- | --- | --- | | [GetDotNetVersion.yaml][link-wf-getdotnet] | Gets the installed .NET SDK version | Windows, Linux | +| [GetClangVersion.yaml][link-wf-getclang] | Gets the installed Clang version | Windows, Linux | | [GetGccVersion.yaml][link-wf-getgcc] | Gets the installed GCC version | Linux | | [GetIarEwArmVersion.yaml][link-wf-getiar] | Gets the installed IAR EW ARM version | Windows | | [GetMsBuildVersion.yaml][link-wf-getmsbuild] | Gets the installed MSBuild version | Windows | @@ -78,6 +79,7 @@ These workflows add a build-tool entry as a package to an existing SPDX document | Workflow | Description | Platform | | --- | --- | --- | | [AddDotNetPackage.yaml][link-wf-adddotnet] | Adds the .NET SDK package to an SPDX document | Windows, Linux | +| [AddClangPackage.yaml][link-wf-addclang] | Adds the Clang package to an SPDX document | Windows, Linux | | [AddGccPackage.yaml][link-wf-addgcc] | Adds the GCC package to an SPDX document | Linux | | [AddIarEwArmPackage.yaml][link-wf-addiar] | Adds the IAR EW ARM package to an SPDX document | Windows | | [AddMsBuildPackage.yaml][link-wf-addmsbuild] | Adds the MSBuild package to an SPDX document | Windows | @@ -119,6 +121,7 @@ MIT License. [link-wf-getdotnet]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetDotNetVersion.yaml +[link-wf-getclang]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetClangVersion.yaml [link-wf-getgcc]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetGccVersion.yaml [link-wf-getiar]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetIarEwArmVersion.yaml [link-wf-getmsbuild]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetMsBuildVersion.yaml @@ -126,6 +129,7 @@ MIT License. [link-wf-getnugetpath]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetNugetPackagePath.yaml [link-wf-getvstest]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetVsTestVersion.yaml [link-wf-adddotnet]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddDotNetPackage.yaml +[link-wf-addclang]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddClangPackage.yaml [link-wf-addgcc]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddGccPackage.yaml [link-wf-addiar]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddIarEwArmPackage.yaml [link-wf-addmsbuild]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddMsBuildPackage.yaml diff --git a/docs/guide/guide.md b/docs/guide/guide.md index cd96b97..262e8f7 100644 --- a/docs/guide/guide.md +++ b/docs/guide/guide.md @@ -59,6 +59,21 @@ Retrieves the version of the installed GCC compiler. - `version`: The GCC version string +### GetClangVersion + +Retrieves the version of the installed Clang compiler. By default this runs +`clang` from the system path; set the `path` parameter to the full path of a +vendor distribution binary (e.g. Arm Toolchain for Embedded) to use a +different Clang install. + +**Parameters:** + +- `path`: Clang program name or full path (default `clang`) + +**Outputs:** + +- `version`: The Clang version string + ### GetIarEwArmVersion Retrieves the version of the installed IAR Embedded Workbench for ARM. @@ -108,6 +123,14 @@ Adds a GCC compiler package to an SPDX document. - `spdx`: Path to the SPDX document +### AddClangPackage + +Adds a Clang compiler package to an SPDX document. + +**Parameters:** + +- `spdx`: Path to the SPDX document + ### AddIarEwArmPackage Adds an IAR EW ARM package to an SPDX document. diff --git a/requirements.yaml b/requirements.yaml index c062a74..0dcd415 100644 --- a/requirements.yaml +++ b/requirements.yaml @@ -55,6 +55,19 @@ sections: tests: - ubuntu@GetGccVersion_OnLinux_ReturnsVersion + - id: SPWF-GET-008 + title: >- + The GetClangVersion workflow shall output the installed Clang + compiler version as a version string. + justification: | + Consumers cross-compiling embedded firmware with Clang/LLVM distributions + (e.g. Arm Toolchain for Embedded) need to capture Clang version + information into SPDX documents to satisfy NTIA minimum elements and + software supply chain transparency requirements. + tests: + - windows@GetClangVersion_OnAnyOS_ReturnsVersion + - ubuntu@GetClangVersion_OnAnyOS_ReturnsVersion + # SPWF-GET-003 is commented out until test coverage is available. # The GetIarEwArmVersion workflow requires IAR EW ARM to be installed in CI. # Pending test: windows@GetIarEwArmVersion_OnWindows_ReturnsVersion diff --git a/test/DemaConsulting.SpdxWorkflows.Tests/AddClangPackage.cs b/test/DemaConsulting.SpdxWorkflows.Tests/AddClangPackage.cs new file mode 100644 index 0000000..e306a75 --- /dev/null +++ b/test/DemaConsulting.SpdxWorkflows.Tests/AddClangPackage.cs @@ -0,0 +1,37 @@ +namespace DemaConsulting.SpdxWorkflows.Tests; + +[TestClass] +public class AddClangPackage : AddPackageTest +{ + [TestMethod, TestCategory("AnyOS")] + public void AddClangPackage_WithValidParameters_AddsPackageToDocument() + { + var doc = RunAddPackageWorkflow( + "AddClangPackage.yaml", + "spdx=spdx.json", + "id=SPDXRef-Package-Clang-16.0.0", + "version=16.0.0"); + + // Verify the package was added + var package = Array.Find(doc.Packages, p => p.Id == "SPDXRef-Package-Clang-16.0.0"); + Assert.IsNotNull(package); + + // Verify the information + Assert.AreEqual("Clang", package.Name); + Assert.AreEqual("Apache-2.0 WITH LLVM-exception", package.ConcludedLicense); + Assert.AreEqual("Copyright (c) LLVM Project contributors", package.CopyrightText); + Assert.AreEqual("16.0.0", package.Version); + Assert.AreEqual("Organization: LLVM Project", package.Supplier); + Assert.AreEqual("Organization: LLVM Project", package.Originator); + Assert.AreEqual("https://clang.llvm.org/", package.HomePage); + Assert.AreEqual( + "Clang is a C, C++, Objective-C, and Objective-C++ compiler front end built on the LLVM compiler infrastructure, commonly used for cross-compiling embedded targets.", + package.Summary); + + // Verify the PURL + Assert.HasCount(1, package.ExternalReferences); + Assert.AreEqual(SpdxModel.SpdxReferenceCategory.PackageManager, package.ExternalReferences[0].Category); + Assert.AreEqual("purl", package.ExternalReferences[0].Type); + Assert.AreEqual("pkg:github/llvm/llvm-project@llvmorg-16.0.0", package.ExternalReferences[0].Locator); + } +} diff --git a/test/DemaConsulting.SpdxWorkflows.Tests/GetClangVersion.cs b/test/DemaConsulting.SpdxWorkflows.Tests/GetClangVersion.cs new file mode 100644 index 0000000..9441178 --- /dev/null +++ b/test/DemaConsulting.SpdxWorkflows.Tests/GetClangVersion.cs @@ -0,0 +1,24 @@ +using System.Text.RegularExpressions; + +namespace DemaConsulting.SpdxWorkflows.Tests; + +[TestClass] +public partial class GetClangVersion : WorkflowTest +{ + [TestMethod, TestCategory("AnyOS")] + public void GetClangVersion_OnAnyOS_ReturnsVersion() + { + // Run the workflow + var exitCode = RunWorkflow( + out var output, + "GetClangVersion.yaml", + "--verbose"); + + // Verify we found a valid Clang version + Assert.AreEqual(0, exitCode); + Assert.MatchesRegex(VersionRegex(), output); + } + + [GeneratedRegex(@"version = \d+\.\d+")] + private static partial Regex VersionRegex(); +} From c1f1b917de0a965b9357b8b0d5807fd753a794f5 Mon Sep 17 00:00:00 2001 From: Sam Sarette Date: Tue, 29 Sep 2026 12:29:07 -0400 Subject: [PATCH 2/2] Potential fix for pull request finding 'Document id, version, and spdx workflow parameters' Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- docs/guide/guide.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/guide/guide.md b/docs/guide/guide.md index 262e8f7..2cba473 100644 --- a/docs/guide/guide.md +++ b/docs/guide/guide.md @@ -130,6 +130,8 @@ Adds a Clang compiler package to an SPDX document. **Parameters:** - `spdx`: Path to the SPDX document +- `id`: Clang package SPDX ID (default `SPDXRef-Package-Clang`) +- `version`: Clang package version ### AddIarEwArmPackage