Skip to content

Commit 979b738

Browse files
jkowalleckjkowalleck
authored
Merge branch 'master' into 2.0-dev
Signed-off-by: Jan Kowalleck <jan.kowalleck@owasp.org>
2 parents 5b0d747 + cb0d734 commit 979b738

21 files changed

+801
-54
lines changed

‎.github/workflows/build_docs.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
steps:
2222
- name: Checkout
2323
# see https://github.com/actions/checkout
24-
uses: actions/checkout@v5
24+
uses: actions/checkout@v6
2525
- name: Set up JDK
2626
# see https://github.com/actions/setup-java
2727
uses: actions/setup-java@v5
@@ -33,7 +33,7 @@ jobs:
3333
run: ./gen.sh
3434
- name: Archive Schema documentation
3535
# https://github.com/actions/upload-artifact
36-
uses: actions/upload-artifact@v5
36+
uses: actions/upload-artifact@v6
3737
with:
3838
name: XML-Schema-documentation
3939
path: docgen/xml/docs
@@ -46,7 +46,7 @@ jobs:
4646
steps:
4747
- name: Checkout
4848
# see https://github.com/actions/checkout
49-
uses: actions/checkout@v5
49+
uses: actions/checkout@v6
5050
- name: Setup Python Environment
5151
# see https://github.com/actions/setup-python
5252
uses: actions/setup-python@v6
@@ -57,7 +57,7 @@ jobs:
5757
run: ./gen.sh
5858
- name: Archive Schema documentation
5959
# https://github.com/actions/upload-artifact
60-
uses: actions/upload-artifact@v5
60+
uses: actions/upload-artifact@v6
6161
with:
6262
name: JSON-Schema-documentation
6363
path: docgen/json/docs
@@ -70,12 +70,12 @@ jobs:
7070
steps:
7171
- name: Checkout
7272
# see https://github.com/actions/checkout
73-
uses: actions/checkout@v5
73+
uses: actions/checkout@v6
7474
- name: Generate Schema documentation
7575
run: ./gen.sh
7676
- name: Archive Schema documentation
7777
# https://github.com/actions/upload-artifact
78-
uses: actions/upload-artifact@v5
78+
uses: actions/upload-artifact@v6
7979
with:
8080
name: PROTO-Schema-documentation
8181
path: docgen/proto/docs

‎.github/workflows/bundle_2.0_schemas.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,12 @@ jobs:
1919

2020
steps:
2121
- name: Checkout repository
22-
uses: actions/checkout@v4
22+
uses: actions/checkout@v6
2323
with:
2424
token: ${{ secrets.GITHUB_TOKEN }}
2525

2626
- name: Setup Node.js
27-
uses: actions/setup-node@v4
27+
uses: actions/setup-node@v6
2828
with:
2929
node-version: '20'
3030

@@ -56,4 +56,4 @@ jobs:
5656
git config --local user.name "github-actions[bot]"
5757
git commit -m "chore: update bundled schemas [skip ci]"
5858
git push
59-
fi
59+
fi

‎.github/workflows/generate_algorithm_families.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Generate Algorithm Families Enum
2+
3+
on:
4+
push:
5+
paths:
6+
- 'schema/cryptography-defs.json'
7+
- 'tools/src/main/python/algorithmFamilyGeneration.py'
8+
workflow_dispatch:
9+
10+
jobs:
11+
generate-families:
12+
runs-on: ubuntu-latest
13+
14+
permissions:
15+
contents: write
16+
pull-requests: write
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v6
21+
with:
22+
token: ${{ secrets.GITHUB_TOKEN }}
23+
persist-credentials: false
24+
25+
- name: Set up Python
26+
uses: actions/setup-python@v5
27+
with:
28+
python-version: '3.x'
29+
30+
- name: Run algorithm family generator
31+
working-directory: tools/src/main/python
32+
run: python3 algorithmFamilyGeneration.py
33+
34+
- name: Create Pull Request
35+
env:
36+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37+
run: |
38+
BRANCH_NAME="update-algorithm-families"
39+
40+
# Configure Git
41+
git config --local user.email "github-actions[bot]@users.noreply.github.com"
42+
git config --local user.name "github-actions[bot]"
43+
44+
# Check for changes
45+
if git diff --quiet schema/cryptography-defs.schema.json; then
46+
echo "No changes to algorithm families"
47+
exit 0
48+
fi
49+
50+
# Create branch and commit
51+
git checkout -b "$BRANCH_NAME"
52+
git add schema/cryptography-defs.schema.json
53+
git commit -m "chore: update algorithm families [skip ci]"
54+
55+
# Push to the branch (use GH_TOKEN for authentication)
56+
git push -u "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" "$BRANCH_NAME" --force
57+
58+
# Create Pull Request using GitHub CLI (gh)
59+
gh pr create \
60+
--title "chore: update algorithm families" \
61+
--body "This PR updates \`schema/cryptography-defs.schema.json\` with the latest algorithm families generated from \`schema/cryptography-defs.json\`." \
62+
--base "master" \
63+
--head "$BRANCH_NAME" || echo "Pull request already exists"

‎.github/workflows/test_java.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ defaults:
1818
permissions: {}
1919

2020
jobs:
21-
test:
21+
test_java:
2222
runs-on: ubuntu-latest
2323
steps:
2424
- name: Checkout
2525
# see https://github.com/actions/checkout
26-
uses: actions/checkout@v5
26+
uses: actions/checkout@v6
2727
- name: Set up JDK
2828
# see https://github.com/actions/setup-java
2929
uses: actions/setup-java@v5

‎.github/workflows/test_js.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ defaults:
2020
permissions: {}
2121

2222
jobs:
23-
test:
23+
test_js:
2424
timeout-minutes: 30
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout
2828
# see https://github.com/actions/checkout
29-
uses: actions/checkout@v5
29+
uses: actions/checkout@v6
3030
- name: Setup Node.js
3131
# see https://github.com/actions/setup-node
3232
uses: actions/setup-node@v6

‎.github/workflows/test_php.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ defaults:
2020
permissions: {}
2121

2222
jobs:
23-
test:
23+
test_php:
2424
timeout-minutes: 30
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout
2828
# see https://github.com/actions/checkout
29-
uses: actions/checkout@v5
29+
uses: actions/checkout@v6
3030
- name: Setup PHP
3131
# see https://github.com/shivammathur/setup-php
3232
uses: shivammathur/setup-php@v2

‎.github/workflows/test_proto.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ defaults:
2020
permissions: {}
2121

2222
jobs:
23-
test:
23+
test_proto:
2424
timeout-minutes: 30
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout
2828
# see https://github.com/actions/checkout
29-
uses: actions/checkout@v5
29+
uses: actions/checkout@v6
3030
- name: Run test
3131
run: ./test.sh

‎.github/workflows/update_spdx_licenses.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
name: Update SPDX licenses
2+
3+
on:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
workflow_dispatch:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
13+
permissions: { }
14+
15+
jobs:
16+
update:
17+
name: Update Schemas
18+
runs-on: ubuntu-latest
19+
outputs:
20+
changed: ${{ steps.diff.outputs.changed }}
21+
version: ${{ steps.version.outputs.version }}
22+
timeout-minutes: 10
23+
steps:
24+
- name: Checkout
25+
# see https://github.com/actions/checkout
26+
uses: actions/checkout@v5
27+
with:
28+
ref: ${{ github.ref_name }}
29+
- name: Set up JDK
30+
# see https://github.com/actions/setup-java
31+
uses: actions/setup-java@v5
32+
with:
33+
java-version: '21'
34+
distribution: 'zulu'
35+
java-package: jdk
36+
- name: Update SPDX
37+
run: tools/updateSpdx.sh
38+
- name: detect version
39+
id: version
40+
run: |
41+
value=$( jq -r '.["$comment"]' schema/spdx.schema.json )
42+
echo "version=$value" >> $GITHUB_OUTPUT
43+
- name: Detect changes
44+
id: diff
45+
run: |
46+
if git diff --quiet -- 'schema/spdx.*'
47+
then
48+
echo "$GITHUB_REF_NAME is up-to-date"
49+
echo "changed=false" >> $GITHUB_OUTPUT
50+
else
51+
echo "$GITHUB_REF_NAME is not up-to-date"
52+
echo "changed=true" >> $GITHUB_OUTPUT
53+
fi
54+
- name: Artifact changes
55+
if: ${{ steps.diff.outputs.changed == 'true' }}
56+
# https://github.com/actions/upload-artifact
57+
uses: actions/upload-artifact@v4
58+
with:
59+
retention-days: 1
60+
name: schema-spdx
61+
path: schema/spdx.*
62+
if-no-files-found: error
63+
pullrequest:
64+
name: Pull-request Changes
65+
runs-on: ubuntu-latest
66+
needs: [ 'update' ]
67+
if: ${{ needs.update.outputs.changed == 'true' }}
68+
permissions:
69+
contents: write # push commits
70+
pull-requests: write # create pullrequests
71+
env:
72+
SB_VERSION: ${{ needs.update.outputs.version }}
73+
SB_BRANCH: ${{ github.ref_name }}_update-spdx/${{ needs.update.outputs.version }}
74+
steps:
75+
- name: Checkout
76+
# see https://github.com/actions/checkout
77+
uses: actions/checkout@v5
78+
with:
79+
ref: ${{ github.ref_name }}
80+
- name: Switch branch
81+
id: branch
82+
run: |
83+
set -eux
84+
git remote set-branches origin "$SB_BRANCH"
85+
if git ls-remote --exit-code --heads origin "$SB_BRANCH"
86+
then
87+
echo "existed=true" >> $GITHUB_OUTPUT
88+
git fetch --depth=1 origin "$SB_BRANCH"
89+
git checkout -b "$SB_BRANCH" "origin/$SB_BRANCH"
90+
else
91+
echo "existed=false" >> $GITHUB_OUTPUT
92+
git checkout -b "$SB_BRANCH"
93+
fi
94+
- name: Fetch changes
95+
# https://github.com/actions/download-artifact
96+
uses: actions/download-artifact@v5
97+
with:
98+
name: schema-spdx
99+
path: schema
100+
- name: Commit and push
101+
run: |
102+
set -eux
103+
if git diff --quiet -- 'schema/spdx.*'
104+
then
105+
echo "branch up-to-date"
106+
exit 0
107+
fi
108+
git config user.name 'spdx-license-bumper[bot]'
109+
git config user.email 'spdx-license-bumper@bot.local'
110+
git add -A schema
111+
git commit -s -m "feat: bump SPDX licenses $SB_VERSION"
112+
git push origin "$SB_BRANCH"
113+
- name: Pull request
114+
if: ${{ steps.branch.outputs.existed == 'false' }}
115+
run: >
116+
gh pr create
117+
--title "feat: bump SPDX Licenses $SB_VERSION"
118+
--body "$SB_VERSION"
119+
--base "$GITHUB_REF_NAME"
120+
--head "$SB_BRANCH"
121+
env:
122+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎schema/bom-1.6.proto‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import "google/protobuf/timestamp.proto";
44

55
// Specifies attributes of the text
66
message AttachedText {
7-
// Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents. [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).
7+
// Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents. [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).
88
optional string content_type = 1;
99
// Specifies the optional encoding the text is represented in
1010
optional string encoding = 2;
@@ -888,7 +888,7 @@ message Vulnerability {
888888
optional Source source = 3;
889889
// Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Oftentimes, the same vulnerability may exist in multiple sources of vulnerability intelligence but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.
890890
repeated VulnerabilityReference references = 4;
891-
// List of vulnerability ratings
891+
// List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.
892892
repeated VulnerabilityRating ratings = 5;
893893
// List of Common Weaknesses Enumerations (CWEs) codes that describe this vulnerability. For example, 399 (of https://cwe.mitre.org/data/definitions/399.html)
894894
repeated int32 cwes = 6;

‎schema/bom-1.6.schema.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2681,7 +2681,7 @@
26812681
"ratings": {
26822682
"type": "array",
26832683
"title": "Ratings",
2684-
"description": "List of vulnerability ratings",
2684+
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
26852685
"items": {
26862686
"$ref": "#/definitions/rating"
26872687
}

0 commit comments

Comments
 (0)