Skip to content

Commit 422b0ad

Browse files
maennchenmaennchen
committed
Setup OSS Review Toolkit SBoM generation
1 parent 28b0ef2 commit 422b0ad

File tree

9 files changed

+549
-28
lines changed

9 files changed

+549
-28
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,27 @@ jobs:
122122
shellcheck -e SC2039,2086 bin/elixir && echo "bin/elixir is POSIX compliant"
123123
shellcheck bin/elixirc && echo "bin/elixirc is POSIX compliant"
124124
shellcheck bin/iex && echo "bin/iex is POSIX compliant"
125+
126+
license_compliance:
127+
name: Check Licence Compliance
128+
129+
runs-on: ubuntu-24.04
130+
131+
steps:
132+
- name: Use HTTPS instead of SSH for Git cloning
133+
id: git-config
134+
shell: bash
135+
run: git config --global url.https://github.com/.insteadOf ssh://[email protected]/
136+
137+
- name: Checkout project
138+
id: checkout
139+
uses: actions/checkout@v4
140+
141+
- name: "Run OSS Review Toolkit"
142+
id: ort
143+
uses: ./.github/workflows/ort
144+
with:
145+
upload-reports: true
146+
fail-on-violation: true
147+
report-formats: "WebApp"
148+
version: "${{ github.sha }}"

‎.github/workflows/ort/action.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: "Run OSS Review Toolkit"
2+
description: "Runs OSS Review Toolkit & generates SBoMs"
3+
inputs:
4+
build-artifacts:
5+
description: |
6+
Build Artifact paths to include into SBoM.
7+
May contain a glob pattern or list of paths separated by a newline.
8+
required: false
9+
default: ""
10+
report-formats:
11+
description: "ORT Report Formats"
12+
required: true
13+
fail-on-violation:
14+
description: "Whether to fail on violation."
15+
required: false
16+
default: false
17+
upload-reports:
18+
description: "Whether to upload all reports"
19+
required: false
20+
default: false
21+
version:
22+
desctiption: "Elixir Version (Tag / SHA)"
23+
required: true
24+
25+
outputs:
26+
results-path:
27+
description: "See oss-review-toolkit/ort-ci-github-action action"
28+
value: "${{ steps.ort.outputs.results-path }}"
29+
results-sbom-cyclonedx-xml-path:
30+
description: "See oss-review-toolkit/ort-ci-github-action action"
31+
value: "${{ steps.ort.outputs.results-sbom-cyclonedx-xml-path }}"
32+
results-sbom-cyclonedx-json-path:
33+
description: "See oss-review-toolkit/ort-ci-github-action action"
34+
value: "${{ steps.ort.outputs.results-sbom-cyclonedx-json-path }}"
35+
results-sbom-spdx-yml-path:
36+
description: "See oss-review-toolkit/ort-ci-github-action action"
37+
value: "${{ steps.ort.outputs.results-sbom-spdx-yml-path }}"
38+
results-sbom-spdx-json-path:
39+
description: "See oss-review-toolkit/ort-ci-github-action action"
40+
value: "${{ steps.ort.outputs.results-sbom-spdx-json-path }}"
41+
42+
runs:
43+
using: "composite"
44+
steps:
45+
- name: Fetch Default ORT Config
46+
id: fetch-default-ort-config
47+
uses: actions/checkout@v4
48+
with:
49+
repository: oss-review-toolkit/ort-config
50+
ref: "main"
51+
path: ".ort-config"
52+
53+
- name: Setup ORT Config
54+
id: setup-ort-config
55+
shell: bash
56+
run: |
57+
mkdir -p "/$HOME/.ort/"
58+
59+
# Move Fetched Default Config into Place
60+
mv .ort-config "/$HOME/.ort/config"
61+
62+
# Append Global ORT Config
63+
cat .ort/config/config.yml >> "$HOME/.ort/config/config.yml"
64+
65+
# Override Default Evaluator Rules
66+
cp .ort/config/evaluator.rules.kts "$HOME/.ort/config/evaluator.rules.kts"
67+
68+
- name: "Cache ScanCode"
69+
uses: actions/cache@v4
70+
with:
71+
path: "~/.cache/scancode-tk"
72+
key: ${{ runner.os }}-scancode
73+
74+
- name: Run OSS Review Toolkit
75+
id: ort
76+
# TODO: Use released version once the following issue has been released:
77+
# * https://github.com/oss-review-toolkit/ort-ci-github-action/issues/37
78+
# * https://github.com/oss-review-toolkit/ort-ci-github-action/pull/41
79+
# * https://github.com/oss-review-toolkit/ort-ci-github-action/pull/43
80+
uses: maennchen/ort-ci-github-action@action-output
81+
with:
82+
image: ghcr.io/oss-review-toolkit/ort-minimal:latest
83+
run: >
84+
labels,
85+
cache-dependencies,
86+
cache-scan-results,
87+
analyzer,
88+
scanner,
89+
advisor,
90+
evaluator,
91+
reporter,
92+
${{ inputs.upload-reports == 'true' && 'upload-results' || '' }}
93+
fail-on: "${{ inputs.fail-on-violation == 'true' && 'violations,issues' || '' }}"
94+
report-formats: "${{ inputs.report-formats }}"
95+
ort-cli-report-args: '-O CycloneDX=output.file.formats=json,xml -O SpdxDocument=outputFileFormats=JSON,YAML'
96+
sw-version: "${{ inputs.version }}"

‎.github/workflows/release.yml‎

Lines changed: 86 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ jobs:
5555
git push origin $ref_name --force
5656
5757
build:
58+
name: "Build Elixir"
59+
5860
strategy:
5961
fail-fast: true
6062
matrix:
@@ -64,7 +66,9 @@ jobs:
6466
- otp: 27
6567
otp_version: "27.0"
6668
build_docs: build_docs
69+
6770
runs-on: ubuntu-22.04
71+
6872
steps:
6973
- uses: actions/checkout@v4
7074
with:
@@ -77,19 +81,6 @@ jobs:
7781
otp: ${{ matrix.otp }}
7882
build_docs: ${{ matrix.build_docs }}
7983

80-
- name: "Attest docs provenance"
81-
uses: actions/attest-build-provenance@v2
82-
id: attest-docs-provenance
83-
if: matrix.build_docs
84-
with:
85-
subject-path: "Docs.zip"
86-
87-
- name: "Copy docs provenance"
88-
if: matrix.build_docs
89-
run: cp "$ATTESTATION" Docs.zip.sigstore
90-
env:
91-
ATTESTATION: "${{ steps.attest-docs-provenance.outputs.bundle-path }}"
92-
9384
- name: Create Docs Hashes
9485
if: matrix.build_docs
9586
run: |
@@ -150,18 +141,6 @@ jobs:
150141
timestamp-rfc3161: http://timestamp.acs.microsoft.com
151142
timestamp-digest: SHA256
152143

153-
- name: "Attest release provenance"
154-
id: attest-provenance
155-
uses: actions/attest-build-provenance@v2
156-
with:
157-
subject-path: ${{ env.RELEASE_FILE }}
158-
159-
- name: "Copy release .zip provenance"
160-
shell: bash
161-
run: cp "$ATTESTATION" "${RELEASE_FILE}.sigstore"
162-
env:
163-
ATTESTATION: "${{ steps.attest-provenance.outputs.bundle-path }}"
164-
165144
- name: Create Release Hashes
166145
if: matrix.flavor == 'windows'
167146
shell: pwsh
@@ -185,14 +164,92 @@ jobs:
185164
name: sign-${{ matrix.flavor }}-elixir-otp-${{ matrix.otp }}
186165
path: ${{ env.RELEASE_FILE }}*
187166

167+
sbom:
168+
name: Generate SBoM
169+
170+
needs: [build, sign]
171+
172+
runs-on: ubuntu-24.04
173+
174+
steps:
175+
- name: Use HTTPS instead of SSH for Git cloning
176+
id: git-config
177+
shell: bash
178+
run: git config --global url.https://github.com/.insteadOf ssh://[email protected]/
179+
180+
- name: Checkout project
181+
id: checkout
182+
uses: actions/checkout@v4
183+
184+
- name: "Download Build Artifacts"
185+
id: download-build-artifacts
186+
uses: actions/download-artifact@v4
187+
with:
188+
pattern: "{sign-*-elixir-otp-*,Docs}"
189+
merge-multiple: true
190+
path: /tmp/build-artifacts/
191+
192+
- name: "Run OSS Review Toolkit"
193+
id: ort
194+
uses: ./.github/workflows/ort
195+
with:
196+
build-artifacts: "/tmp/build-artifacts/*"
197+
report-formats: "CycloneDx,SpdxDocument"
198+
version: "${{ github.ref_type == 'tag' && github.ref_name || github.sha }}"
199+
200+
- name: Attest Distribution Assets with SBoM
201+
id: attest-sbom
202+
uses: actions/attest-sbom@v2
203+
with:
204+
subject-path: |
205+
/tmp/build-artifacts/{elixir-otp-*.*,Docs.zip}
206+
${{ steps.ort.outputs.results-sbom-cyclonedx-xml-path }}
207+
${{ steps.ort.outputs.results-sbom-cyclonedx-json-path }}
208+
${{ steps.ort.outputs.results-sbom-spdx-yml-path }}
209+
${{ steps.ort.outputs.results-sbom-spdx-json-path }}
210+
sbom-path: "${{ steps.ort.outputs.results-sbom-spdx-json-path }}"
211+
212+
- name: "Copy SBoM provenance"
213+
id: sbom-provenance
214+
shell: bash
215+
run: |
216+
mkdir attestations
217+
218+
for FILE in /tmp/build-artifacts/{elixir-otp-*.*,Docs.zip}; do
219+
cp "$ATTESTATION" "attestations/$(basename "$FILE").sigstore"
220+
done
221+
222+
cp "$ATTESTATION" "attestations/$(basename "${{ steps.ort.outputs.results-sbom-cyclonedx-xml-path }}").sigstore"
223+
cp "$ATTESTATION" "attestations/$(basename "${{ steps.ort.outputs.results-sbom-cyclonedx-json-path }}").sigstore"
224+
cp "$ATTESTATION" "attestations/$(basename "${{ steps.ort.outputs.results-sbom-spdx-yml-path }}").sigstore"
225+
cp "$ATTESTATION" "attestations/$(basename "${{ steps.ort.outputs.results-sbom-spdx-json-path }}").sigstore"
226+
env:
227+
ATTESTATION: "${{ steps.attest-sbom.outputs.bundle-path }}"
228+
229+
- name: "Assemble Release SBoM Artifacts"
230+
uses: actions/upload-artifact@v4
231+
with:
232+
name: "SBoM"
233+
path: |
234+
${{ steps.ort.outputs.results-sbom-cyclonedx-xml-path }}
235+
${{ steps.ort.outputs.results-sbom-cyclonedx-json-path }}
236+
${{ steps.ort.outputs.results-sbom-spdx-yml-path }}
237+
${{ steps.ort.outputs.results-sbom-spdx-json-path }}
238+
239+
- name: "Assemble Distribution Attestations"
240+
uses: actions/upload-artifact@v4
241+
with:
242+
name: "Attestations"
243+
path: "attestations/*.sigstore"
244+
188245
upload-release:
189-
needs: [create_draft_release, build, sign]
246+
needs: [create_draft_release, build, sign, sbom]
190247
runs-on: ubuntu-22.04
191248

192249
steps:
193250
- uses: actions/download-artifact@v4
194251
with:
195-
pattern: "{sign-*-elixir-otp-*,Docs}"
252+
pattern: "{sign-*-elixir-otp-*,Docs,SBoM,Attestations}"
196253
merge-multiple: true
197254

198255
- name: Upload Pre-built
@@ -218,7 +275,8 @@ jobs:
218275
elixir-otp-*.exe.sigstore \
219276
Docs.zip \
220277
Docs.zip.sha{1,256}sum \
221-
Docs.zip.sigstore
278+
Docs.zip.sigstore \
279+
bom.*
222280
223281
upload-builds-hex-pm:
224282
needs: [build, sign]

‎.ort.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
curations:
2+
license_findings:
3+
- path: "lib/elixir/pages/images/logo.png"
4+
reason: "INCORRECT"
5+
comment: "Apply Trademark Policy to Elixir Logo"
6+
detected_license: "NONE"
7+
concluded_license: "LicenseRef-elixir-trademark-policy"
8+
9+
- path: "lib/elixir/pages/references/library-guidelines.md"
10+
reason: "INCORRECT"
11+
comment: |
12+
The guide mentions multiple licenses for users to choose from.
13+
It however is not licensed itself by the mentioned licenses.
14+
concluded_license: "Apache-2.0"
15+
16+
- path: "**/*"
17+
reason: "INCORRECT"
18+
comment: "Apply default license to all unknown files"
19+
detected_license: "NONE"
20+
concluded_license: "Apache-2.0"

‎.ort/config/config.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
ort:
2+
scanner:
3+
skipConcluded: false
4+
includeFilesWithoutFindings: true
5+
6+
analyzer:
7+
allowDynamicVersions: true
8+
enabledPackageManagers: [Unmanaged]
9+
skipExcluded: true

0 commit comments

Comments
 (0)