Add GetClangVersion and AddClangPackage workflows

.cspell.json

@@ -33,6 +33,7 @@
     "LINQ",
     "libgcj",
     "libstdc",
+    "llvmorg",
     "maintainer",
     "markdownlint",
     "mermaid",

AddClangPackage.yaml

@@ -0,0 +1,42 @@
+# AddClangPackage
+#
+# This SpdxTool workflow file adds a Clang/LLVM package entry to an SPDX
+# document. The Clang/LLVM package information was attained from:
+# - https://clang.llvm.org/
+# - https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT
+#
+# Parameters:
+# - spdx        # SPDX document file name
+# - id          # Clang Package ID
+# - version     # Clang Package version
+#
+# Outputs:
+#   none
+
+parameters:
+  spdx: ''
+  version: ''
+  id: 'SPDXRef-Package-Clang'
+
+
+steps:
+
+  # Add the Clang package
+  - command: add-package
+    inputs:
+      spdx: ${{ spdx }}
+      package:
+        id: ${{ id }}
+        name: Clang
+        download: NOASSERTION
+        license: 'Apache-2.0 WITH LLVM-exception'
+        copyright: 'Copyright (c) LLVM Project contributors'
+        version: ${{ version }}
+        supplier: 'Organization: LLVM Project'
+        originator: 'Organization: LLVM Project'
+        homepage: https://clang.llvm.org/
+        summary: >-
+          Clang is a C, C++, Objective-C, and Objective-C++ compiler front end built on the
+          LLVM compiler infrastructure, commonly used for cross-compiling embedded targets.
+        purl: pkg:github/llvm/llvm-project@llvmorg-${{ version }}
+      relationships: []

GetClangVersion.yaml

@@ -0,0 +1,27 @@
+# GetClangVersion
+#
+# This SpdxTool workflow file gets the version of the clang compiler. By
+# default this runs 'clang' from the system path, but the 'path' parameter
+# can be set to the full path of a vendor distribution binary (e.g. the Arm
+# Toolchain for Embedded 'clang' executable).
+#
+# Parameters:
+#   path:       # Clang program name or full path (default 'clang')
+#
+# Outputs:
+# - version     # Version of the clang compiler
+
+parameters:
+  path: 'clang'
+
+
+steps:
+
+  # Query the version of clang
+  - command: query
+    inputs:
+      output: version
+      pattern: 'clang version (?<value>\S+)'
+      program: '${{ path }}'
+      arguments:
+        - '--version'

README.md

@@ -15,9 +15,9 @@ materials (SBOMs).
 This collection provides:
 
 - **Version Discovery Workflows**: Detect and capture the installed versions of common build
-  tools — .NET SDK, GCC, MSBuild, NuGet, VSTest, and IAR EW ARM
-- **SPDX Package Workflows**: Add build-tool packages to an SPDX document — .NET SDK, GCC,
-  MSBuild, NuGet, VSTest, and IAR EW ARM
+  tools — .NET SDK, Clang, GCC, MSBuild, NuGet, VSTest, and IAR EW ARM
+- **SPDX Package Workflows**: Add build-tool packages to an SPDX document — .NET SDK, Clang,
+  GCC, MSBuild, NuGet, VSTest, and IAR EW ARM
 - **NuGet SPDX Enhancement**: Enrich an SPDX document package with metadata sourced from a
   NuGet package's own SPDX document
 - **Multi-Platform Support**: Workflows target Windows and Linux build environments
@@ -64,6 +64,7 @@ discovery workflows produce a single `version` output parameter.
 | Workflow | Description | Platform |
 | --- | --- | --- |
 | [GetDotNetVersion.yaml][link-wf-getdotnet] | Gets the installed .NET SDK version | Windows, Linux |
+| [GetClangVersion.yaml][link-wf-getclang] | Gets the installed Clang version | Windows, Linux |
 | [GetGccVersion.yaml][link-wf-getgcc] | Gets the installed GCC version | Linux |
 | [GetIarEwArmVersion.yaml][link-wf-getiar] | Gets the installed IAR EW ARM version | Windows |
 | [GetMsBuildVersion.yaml][link-wf-getmsbuild] | Gets the installed MSBuild version | Windows |
@@ -78,6 +79,7 @@ These workflows add a build-tool entry as a package to an existing SPDX document
 | Workflow | Description | Platform |
 | --- | --- | --- |
 | [AddDotNetPackage.yaml][link-wf-adddotnet] | Adds the .NET SDK package to an SPDX document | Windows, Linux |
+| [AddClangPackage.yaml][link-wf-addclang] | Adds the Clang package to an SPDX document | Windows, Linux |
 | [AddGccPackage.yaml][link-wf-addgcc] | Adds the GCC package to an SPDX document | Linux |
 | [AddIarEwArmPackage.yaml][link-wf-addiar] | Adds the IAR EW ARM package to an SPDX document | Windows |
 | [AddMsBuildPackage.yaml][link-wf-addmsbuild] | Adds the MSBuild package to an SPDX document | Windows |
@@ -119,13 +121,15 @@ MIT License.
 
 <!-- Workflow file references -->
 [link-wf-getdotnet]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetDotNetVersion.yaml
+[link-wf-getclang]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetClangVersion.yaml
 [link-wf-getgcc]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetGccVersion.yaml
 [link-wf-getiar]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetIarEwArmVersion.yaml
 [link-wf-getmsbuild]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetMsBuildVersion.yaml
 [link-wf-getnuget]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetNugetVersion.yaml
 [link-wf-getnugetpath]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetNugetPackagePath.yaml
 [link-wf-getvstest]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/GetVsTestVersion.yaml
 [link-wf-adddotnet]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddDotNetPackage.yaml
+[link-wf-addclang]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddClangPackage.yaml
 [link-wf-addgcc]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddGccPackage.yaml
 [link-wf-addiar]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddIarEwArmPackage.yaml
 [link-wf-addmsbuild]: https://github.com/demaconsulting/SpdxWorkflows/blob/main/AddMsBuildPackage.yaml

docs/guide/guide.md

@@ -59,6 +59,21 @@ Retrieves the version of the installed GCC compiler.
 
 - `version`: The GCC version string
 
+### GetClangVersion
+
+Retrieves the version of the installed Clang compiler. By default this runs
+`clang` from the system path; set the `path` parameter to the full path of a
+vendor distribution binary (e.g. Arm Toolchain for Embedded) to use a
+different Clang install.
+
+**Parameters:**
+
+- `path`: Clang program name or full path (default `clang`)
+
+**Outputs:**
+
+- `version`: The Clang version string
+
 ### GetIarEwArmVersion
 
 Retrieves the version of the installed IAR Embedded Workbench for ARM.
@@ -108,6 +123,16 @@ Adds a GCC compiler package to an SPDX document.
 
 - `spdx`: Path to the SPDX document
 
+### AddClangPackage
+
+Adds a Clang compiler package to an SPDX document.
+
+**Parameters:**
+
+- `spdx`: Path to the SPDX document
+- `id`: Clang package SPDX ID (default `SPDXRef-Package-Clang`)
+- `version`: Clang package version
+
 ### AddIarEwArmPackage
 
 Adds an IAR EW ARM package to an SPDX document.

requirements.yaml

@@ -55,6 +55,19 @@ sections:
         tests:
           - ubuntu@GetGccVersion_OnLinux_ReturnsVersion
 
+      - id: SPWF-GET-008
+        title: >-
+          The GetClangVersion workflow shall output the installed Clang
+          compiler version as a version string.
+        justification: |
+          Consumers cross-compiling embedded firmware with Clang/LLVM distributions
+          (e.g. Arm Toolchain for Embedded) need to capture Clang version
+          information into SPDX documents to satisfy NTIA minimum elements and
+          software supply chain transparency requirements.
+        tests:
+          - windows@GetClangVersion_OnAnyOS_ReturnsVersion
+          - ubuntu@GetClangVersion_OnAnyOS_ReturnsVersion
+
       # SPWF-GET-003 is commented out until test coverage is available.
       # The GetIarEwArmVersion workflow requires IAR EW ARM to be installed in CI.
       # Pending test: windows@GetIarEwArmVersion_OnWindows_ReturnsVersion

test/DemaConsulting.SpdxWorkflows.Tests/AddClangPackage.cs

@@ -0,0 +1,37 @@
+namespace DemaConsulting.SpdxWorkflows.Tests;
+
+[TestClass]
+public class AddClangPackage : AddPackageTest
+{
+    [TestMethod, TestCategory("AnyOS")]
+    public void AddClangPackage_WithValidParameters_AddsPackageToDocument()
+    {
+        var doc = RunAddPackageWorkflow(
+            "AddClangPackage.yaml",
+            "spdx=spdx.json",
+            "id=SPDXRef-Package-Clang-16.0.0",
+            "version=16.0.0");
+
+        // Verify the package was added
+        var package = Array.Find(doc.Packages, p => p.Id == "SPDXRef-Package-Clang-16.0.0");
+        Assert.IsNotNull(package);
+
+        // Verify the information
+        Assert.AreEqual("Clang", package.Name);
+        Assert.AreEqual("Apache-2.0 WITH LLVM-exception", package.ConcludedLicense);
+        Assert.AreEqual("Copyright (c) LLVM Project contributors", package.CopyrightText);
+        Assert.AreEqual("16.0.0", package.Version);
+        Assert.AreEqual("Organization: LLVM Project", package.Supplier);
+        Assert.AreEqual("Organization: LLVM Project", package.Originator);
+        Assert.AreEqual("https://clang.llvm.org/", package.HomePage);
+        Assert.AreEqual(
+            "Clang is a C, C++, Objective-C, and Objective-C++ compiler front end built on the LLVM compiler infrastructure, commonly used for cross-compiling embedded targets.",
+            package.Summary);
+
+        // Verify the PURL
+        Assert.HasCount(1, package.ExternalReferences);
+        Assert.AreEqual(SpdxModel.SpdxReferenceCategory.PackageManager, package.ExternalReferences[0].Category);
+        Assert.AreEqual("purl", package.ExternalReferences[0].Type);
+        Assert.AreEqual("pkg:github/llvm/[email protected]", package.ExternalReferences[0].Locator);
+    }
+}

test/DemaConsulting.SpdxWorkflows.Tests/GetClangVersion.cs

@@ -0,0 +1,24 @@
+using System.Text.RegularExpressions;
+
+namespace DemaConsulting.SpdxWorkflows.Tests;
+
+[TestClass]
+public partial class GetClangVersion : WorkflowTest
+{
+    [TestMethod, TestCategory("AnyOS")]
+    public void GetClangVersion_OnAnyOS_ReturnsVersion()
+    {
+        // Run the workflow
+        var exitCode = RunWorkflow(
+            out var output,
+            "GetClangVersion.yaml",
+            "--verbose");
+
+        // Verify we found a valid Clang version
+        Assert.AreEqual(0, exitCode);
+        Assert.MatchesRegex(VersionRegex(), output);
+    }
+
+    [GeneratedRegex(@"version = \d+\.\d+")]
+    private static partial Regex VersionRegex();
+}