CI: Update Dockerfile, Deps, CMake Profiling & SBOM

[xsscx]

PR Summary

#2600 CI QA: ci-pr-action & ci-docker

Checklist

• Signed all Commits in PR
• Built locally according to docs/build.md
• Followed the guidelines in Contributing document
• Ran relevant CTest/profile tests from docs/ctest.md
• Updated documentation for user-visible behavior changes
• Ran sanitizer coverage for memory-safety or parser changes
• Added or updated regression coverage for behavior changes
• Attached a base...HEAD contract matrix for cross-cutting changes:
  producer, consumer, build/runtime behavior, platform/toolchain boundary,
  CI trigger, dependency owner, and local evidence
• Reviewed active and suppressed automated findings from review threads and summaries
• For Python package changes, followed docs/python-packaging-release.md for PR and merge requirements
• Did not change maintainer-owned workflow, CTest, CPack, sanitizer, release, or security infrastructure unless requested by an iccDEV maintainer
• New source files include the ICC copyright and BSD 3-Clause license header
• Code style matches nearby code: 2-space indent, K&R braces, m_ members

Legal Requirements

All official software projects hosted by the International Color Consortium (ICC)
follows the open source software best practice policies. The International Color Consortium IP policy governs ICC specification development and contributions to ICC open source software. Software contributions are also covered by the Contributor License Agreement (CLA).

Contributor License Agreements

Developers who wish to contribute code to be considered for inclusion
in ICC software must first complete a Contributor License Agreement
(CLA).

There is no cost or membership requirement to sign the ICC Contributor License Agreement (CLA). Please note that this is different from membership in the International Color Consortium (ICC). If your organization relies on our projects, please become a member. Membership dues are an essential source of funding and investment for these projects.

• If you are an individual writing the code on your own time and you are SURE you are the sole owner of any intellectual property you contribute, you can sign the CLA as an individual contributor.

• If you are writing the code as part of your job, or if there is any possibility that your employer might think they own any intellectual property you create, then you should use the Corporate Contributor Licence Agreement

License

ICC software is licensed under the BSD 3-Clause "New" or "Revised" License. Contributions to ICC software projects should abide by that license unless otherwised specified or approved by the ICC.

Copyright Notices

All new source files must begin with the ICC Copyright notice and include or reference the BSD 3-Clause "New" or "Revised" License.

INTELLECTUAL PROPERTY & PATENTS

Participation in ICC's development activities is subject to ICC's Patent Policy.

Maintainer Review Required

If you have questions, contact a listed Maintainer.

[Copilot]

Copilot review overview

🟡 Changes recommended

The new CMake source lacks the required BSD license reference, and the profiling matrix does not exercise the changed Clang path.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Profiling entry does not select Clang toolchain · New
• Add required BSD 3-Clause SPDX license reference · New

What changed in this PR

Adds profiling tooling and validation to the unified container, strengthens SBOM publication, and introduces defensive runtime checks.

Changes:

• Adds gprof/perf/FlameGraph tooling and profiling smoke coverage.
• Migrates published SBOMs to validated CycloneDX attestations.
• Adds null and invalid-input safeguards to visualization and benchmark code.

File	Description
Dockerfile	Installs profiling tools and pinned FlameGraph.
.github/​workflows/​ci-docker.yml	Validates tooling and publishes CycloneDX SBOMs.
.github/​workflows/​_build-matrix.yml	Adds a profiling configuration.
Build/​Cmake/​CMakeLists.txt	Refines profiling flags and compiler probes.
Build/​Cmake/​Testing/​CMakeLists.txt	Registers the profiling smoke test.
Build/​Cmake/​Testing/​RunProfilingSmokeTest.cmake	Implements gprof output validation.
Tools/​CmdLine/​IccBenchApply/​BenchTimer.h	Handles invalid repeat counts.
Tools/​CmdLine/​IccProfileVisualize/​MiniPDF.cpp	Guards missing PDF parent objects.
Tools/​CmdLine/​IccProfileVisualize/​dataToPDF.cpp	Guards invalid visualization pages.
.github/​scripts/​iccdev-clut-profile.sh	Supports the canonical FlameGraph variable.
.github/​ci/​docker/​iccdev-banner.sh	Reports newly available profiling tools.
.github/​skills/​regression-container-maintainer/​SKILL.md	Documents profiling validation procedures.
.github/​skills/​avx2-clut-diagnostics/​SKILL.md	Updates FlameGraph configuration guidance.
.github/​prompts/​regression-container-maintainer.prompt.md	Adds instrumentation handoff fields.
docs/​regression-container.md	Documents container profiling and SBOM behavior.
docs/​ctest.md	Documents the profiling smoke test.
docs/​build.md	Updates profiling commands and FlameGraph setup.
docs/​avx2-clut-diagnostics.md	Documents the canonical FlameGraph variable.

[Copilot]

Copilot review overview

🟡 Changes recommended

Final image tags are pushed before mandatory SBOM validation and attestation can fail.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Validate SBOM before publishing final image tags · New

Resolved since last review (2)

• Profiling entry does not select Clang toolchain
• Add required BSD 3-Clause SPDX license reference

Previously missed (1)

In code that hasn't changed since last review

Add issue or PR traceability label to regression

Build/​Cmake/​Testing/​CMakeLists.txt:191

The new regression has no issue/PR traceability label. Repository regression governance requires every new gate to state its issue or PR number (docs/regression-workflow-governance.md:51-57); add the linked issue label so future maintainers can trace why this gate exists.

[xsscx]

Pre Merge Report

2026-09-19 16:42:48 UTC

Agent Reports

• Image job: success in 12m13s.
• SBOM generation and validation: success.
• Immutable digest: sha256:445ae530…72fd361.
• Provenance and SBOM attestations uploaded successfully for that digest.
• Final tags were published only after attestation and point to the same digest.
• Independent GitHub attestation verification passed for commit f84a2cf.
• Remaining warnings were expected package/CMake probe messages.

No corrections are needed.