Skip to content

Commit 0156113

Browse files
javihernandezjavihernandez
committed
Merge branch 'sbom' into javi-gcp-images-sbom
2 parents 78d912e + 61846ce commit 0156113

File tree

4 files changed

+117
-60
lines changed

4 files changed

+117
-60
lines changed

‎.github/actions/shared-steps/action.yml‎

Lines changed: 95 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -393,6 +393,26 @@ runs:
393393
# Install ansible
394394
sudo ${{ env.runner_os == 'ubuntu' && 'apt-get' || 'dnf -q' }} -y install ansible
395395
396+
- name: Clone SBOM tools
397+
shell: bash
398+
run: |
399+
rm -rf sbom-tools
400+
git clone --depth=1 https://github.com/javihernandez/cloud-images-sbom-tools.git sbom-tools
401+
402+
- name: Set up Python and install generator deps
403+
uses: actions/setup-python@v5
404+
with:
405+
python-version: '3.11'
406+
cache: 'pip'
407+
cache-dependency-path: sbom-tools/requirements.txt
408+
409+
- name: Create venv and install
410+
shell: bash
411+
run: |
412+
python -m venv .venv-sbom
413+
. .venv-sbom/bin/activate
414+
pip install -r sbom-tools/requirements.txt
415+
396416
- name: Initialize packer
397417
shell: bash
398418
run: sudo /usr/bin/packer init -upgrade .
@@ -419,66 +439,66 @@ runs:
419439
echo "IMAGE_NAME=$(basename ${image_file})" >> $GITHUB_ENV
420440
421441
# don't fail if this doesn't exist, we may not always generate it
422-
sudo mv repo-metadata-*.txt $(basename ${image_file}).repo-metadata.txt || true
423-
424-
- id: 'google-auth-dev-images'
425-
if: env.IMAGE_TYPE == 'gcp'
426-
uses: 'google-github-actions/auth@v2'
427-
with:
428-
workload_identity_provider: 'projects/443728870479/locations/global/workloadIdentityPools/github-actions/providers/github'
429-
service_account: 'github-actions-cloud-images@almalinux-dev-images-469421.iam.gserviceaccount.com'
430-
431-
- name: 'Set up Google Cloud SDK'
432-
if: env.IMAGE_TYPE == 'gcp'
433-
uses: 'google-github-actions/[email protected]'
434-
435-
- name: 'Upload output to GCP storage bucket'
436-
if: env.IMAGE_TYPE == 'gcp'
437-
shell: bash
438-
run: gcloud storage cp ${{ env.IMAGE_FILE }} gs://almalinux-images-dev/almalinux-${version_major}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}-v$(date +'%Y%m%d')/root.tar.gz
439-
440-
- name: Clone gce_image_publish repo
441-
if: env.IMAGE_TYPE == 'gcp'
442-
uses: actions/checkout@v5
443-
with:
444-
path: compute-image-tools
445-
repository: GoogleCloudPlatform/compute-image-tools
446-
ref: "20250916.00"
447-
448-
- name: Build gce_image_publish tool
449-
if: env.IMAGE_TYPE == 'gcp'
450-
shell: bash
451-
run: |
452-
# we need golang
453-
case ${{ env.runner_os }} in
454-
ubuntu)
455-
sudo apt update
456-
sudo apt-get -y install golang-go
457-
;;
458-
rhel)
459-
sudo dnf -y -q install golang
460-
;;
461-
esac
462-
# print golang version for reference
463-
go version
464-
# Build gce_image_publish tool
465-
cd compute-image-tools/cli_tools/gce_image_publish
466-
go mod tidy
467-
go install
468-
469-
- name: Create test image on GCP
470-
if: env.IMAGE_TYPE == 'gcp'
471-
shell: bash
472-
run: |
473-
/home/$USER/go/bin/gce_image_publish \
474-
-var:environment=test \
475-
-skip_confirmation \
476-
-rollout_rate=0 \
477-
-publish_project="almalinux-dev-images-469421" \
478-
-work_project="almalinux-dev-images-469421" \
479-
-replace \
480-
-source_gcs_path="gs://almalinux-images-dev/" \
481-
vm-scripts/gcp/almalinux_${version_major}${{ inputs.arch == 'aarch64' && '_arm64' || '' }}.publish.json
442+
# sudo mv repo-metadata-*.txt $(basename ${image_file}).repo-metadata.txt || true
443+
444+
#- id: 'google-auth-dev-images'
445+
# if: env.IMAGE_TYPE == 'gcp'
446+
# uses: 'google-github-actions/auth@v2'
447+
# with:
448+
# workload_identity_provider: 'projects/443728870479/locations/global/workloadIdentityPools/github-actions/providers/github'
449+
# service_account: 'github-actions-cloud-images@almalinux-dev-images-469421.iam.gserviceaccount.com'
450+
#
451+
#- name: 'Set up Google Cloud SDK'
452+
# if: env.IMAGE_TYPE == 'gcp'
453+
# uses: 'google-github-actions/[email protected]'
454+
455+
#- name: 'Upload output to GCP storage bucket'
456+
# if: env.IMAGE_TYPE == 'gcp'
457+
# shell: bash
458+
# run: gcloud storage cp ${{ env.IMAGE_FILE }} gs://almalinux-images-dev/almalinux-${version_major}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}-v$(date +'%Y%m%d')/root.tar.gz
459+
460+
#- name: Clone gce_image_publish repo
461+
# if: env.IMAGE_TYPE == 'gcp'
462+
# uses: actions/checkout@v5
463+
# with:
464+
# path: compute-image-tools
465+
# repository: GoogleCloudPlatform/compute-image-tools
466+
# ref: "20250916.00"
467+
468+
#- name: Build gce_image_publish tool
469+
# if: env.IMAGE_TYPE == 'gcp'
470+
# shell: bash
471+
# run: |
472+
# # we need golang
473+
# case ${{ env.runner_os }} in
474+
# ubuntu)
475+
# sudo apt update
476+
# sudo apt-get -y install golang-go
477+
# ;;
478+
# rhel)
479+
# sudo dnf -y -q install golang
480+
# ;;
481+
# esac
482+
# # print golang version for reference
483+
# go version
484+
# # Build gce_image_publish tool
485+
# cd compute-image-tools/cli_tools/gce_image_publish
486+
# go mod tidy
487+
# go install
488+
489+
#- name: Create test image on GCP
490+
# if: env.IMAGE_TYPE == 'gcp'
491+
# shell: bash
492+
# run: |
493+
# /home/$USER/go/bin/gce_image_publish \
494+
# -var:environment=test \
495+
# -skip_confirmation \
496+
# -rollout_rate=0 \
497+
# -publish_project="almalinux-dev-images-469421" \
498+
# -work_project="almalinux-dev-images-469421" \
499+
# -replace \
500+
# -source_gcs_path="gs://almalinux-images-dev/" \
501+
# vm-scripts/gcp/almalinux_${version_major}${{ inputs.arch == 'aarch64' && '_arm64' || '' }}.publish.json
482502

483503
# - name: 'Run Google cloud-image-testing tests (basic suite)'
484504
# if: env.IMAGE_TYPE == 'gcp' && inputs.run_test == 'true'
@@ -492,6 +512,21 @@ runs:
492512
# -images 'projects/almalinux-dev-images-469421/global/images/family/almalinux-${{ env.version_major }}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}' \
493513
# -parallel_stagger 10s -parallel_count 20
494514

515+
# TODO
516+
- name: Generate SBOM
517+
shell: bash
518+
run: |
519+
. ./.venv-sbom/bin/activate
520+
mkdir -p sbom
521+
shopt -s nullglob
522+
for f in sbom-data/sbom-data*.json; do
523+
base=$(basename "$f" .json)
524+
python3 sbom-tools/sbom_generator.py "${base}" "$f" "${base}.spdx.json" -v
525+
done
526+
527+
# - name: Setup tmate session
528+
# uses: mxschmitt/action-tmate@v3
529+
495530
- name: Test ${{ inputs.type }} ${{ inputs.variant }} image
496531
# Skip testing for vagrant_virtualbox on GH runner because 'vugrant up' fails to connect to the newly created VM via ssh:
497532
# kex_exchange_identification: read: Connection reset by peer

‎ansible/roles/cleanup_vm/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
---
22
cleanup_ssh_host_keys: true
3+
collect_sbom_data: true

‎ansible/roles/cleanup_vm/tasks/main.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
---
2+
- name: Include sbom_data role for SBOM data collection
3+
include_role:
4+
name: sbom_data
5+
when: collect_sbom_data | bool
6+
27
- name: Remove older versions kernel and other packages
38
ansible.builtin.command: dnf -y remove --oldinstallonly
49
register: removeoldoutput

‎ansible/roles/sbom_data/tasks/main.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
- name: Copy SBOM data collector into the system
3+
ansible.builtin.copy:
4+
src: "{{ playbook_dir }}/../sbom-tools/sbom_data_collector.py"
5+
dest: /dev/shm/sbom_data_collector.py
6+
7+
- name: Collect SBOM data from the system
8+
ansible.builtin.shell: python3 /dev/shm/sbom_data_collector.py -o /dev/shm/sbom-data.json -v
9+
register: sbom_data_collector
10+
11+
- name: Write repo metadata for SBOMs to artifact file
12+
ansible.builtin.fetch:
13+
src: /dev/shm/sbom-data.json
14+
dest: "{{ playbook_dir }}/../sbom-data/sbom-data-{{ packer_build_name }}.json"
15+
flat: true
16+
become: false

0 commit comments

Comments
 (0)