@@ -230,86 +230,3 @@ jobs:
230230 GIT_USER_NAME : ${{ secrets.GO_GIT_USER_NAME }}
231231 GIT_USER_EMAIL : ${{ secrets.GO_GIT_USER_EMAIL }}
232232 run : npx -p publib@latest publib-golang
233- release_github :
234- name : Publish to GitHub Releases
235- needs : [release, release_npm, release_maven, release_pypi, release_nuget, release_golang]
236- runs-on : ubuntu-latest
237- permissions :
238- contents : write
239- issues : write
240- steps :
241- - uses : actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
242- with :
243- node-version : 24.x
244- - name : Download build artifacts
245- uses : actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53
246- with :
247- name : build-artifact
248- path : dist
249- - name : Restore build artifact permissions
250- run : cd dist && setfacl --restore=permissions-backup.acl
251- continue-on-error : true
252- - name : Extract Version
253- id : extract-version
254- run : echo "VERSION=$(cat dist/version.txt)" >> "${GITHUB_OUTPUT}"
255- - name : Release
256- env :
257- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
258- GITHUB_REPOSITORY : ${{ github.repository }}
259- GITHUB_REF : ${{ github.ref }}
260- run : errout=$(mktemp); gh release create "$(cat dist/releasetag.txt)" -R "${GITHUB_REPOSITORY}" -F dist/changelog.md -t "$(cat dist/releasetag.txt)" --target "${GITHUB_REF}" 2> "$errout" && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" "$errout"; then cat "$errout"; exit $exitcode; fi
261- - uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
262- - name : Generate PURL and SBOM
263- run : |
264- ./scripts/compliance/gen-purls.sh
265- ./scripts/compliance/gen-sbom.sh
266- env :
267- SILKBOMB_IMG : ${{ vars.SILKBOMB_IMG }}
268- - name : Upload SBOM to Kondukto
269- run : ./scripts/compliance/upload-sbom.sh
270- env :
271- KONDUKTO_TOKEN : ${{ secrets.KONDUKTO_TOKEN }}
272- SILKBOMB_IMG : ${{ vars.SILKBOMB_IMG }}
273- KONDUKTO_REPO : ${{ vars.KONDUKTO_REPO }}
274- KONDUKTO_BRANCH_PREFIX : ${{ vars.KONDUKTO_BRANCH_PREFIX }}
275-
276- - name : Generate SSDLC report
277- run : |
278- AUTHOR="${{ github.actor }}"
279- export AUTHOR
280- VERSION="${{ steps.extract-version.outputs.VERSION }}"
281- export VERSION
282- ./scripts/compliance/gen-ssdlc-report.sh
283- env :
284- KONDUKTO_TOKEN : ${{ secrets.KONDUKTO_TOKEN }}
285- SILKBOMB_IMG : ${{ vars.SILKBOMB_IMG }}
286- KONDUKTO_REPO : ${{ vars.KONDUKTO_REPO }}
287- KONDUKTO_BRANCH_PREFIX : ${{ vars.KONDUKTO_BRANCH_PREFIX }}
288- - name : Import GPG key
289- uses : crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec
290- with :
291- gpg_private_key : ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
292- passphrase : ${{ secrets.APIX_BOT_PASSPHRASE }}
293- git_user_signingkey : true
294- git_commit_gpgsign : true
295- - name : Commit changes
296- shell : bash
297- run : |
298- if [[ $(git status --porcelain) ]]; then
299- git pull
300- git config --local user.email [email protected] 301- git config --local user.name svc-apix-bot
302- git remote set-url origin https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
303- git add compliance/v*/*
304- git commit -m "chore: Update SSDLC report for ${{ steps.extract-version.outputs.VERSION }}"
305- git push origin
306- else
307- echo "No changes to commit."
308- fi
309- - name : Upload SBOM as release artifact
310- uses : softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090
311- with :
312- files : compliance/sbom.json
313- tag_name : ${{ steps.extract-version.outputs.VERSION }}
314- env :
315- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
0 commit comments