Skip to content

Commit f779a7a

Browse files
oarbusioarbusi
authored
chore: Onboard Silkbomb in the CI (#3374)
* generate purls * check purls * run acceptance test only after check-purls * gen-purls before checking * generate sbom script * make target check purls * upload sbom to kondukto and release artifacts * remove comment * double quotes shellcheck * move gen purls to script * update purls.txt on dependabot PRs
1 parent a44a363 commit f779a7a

File tree

10 files changed

+248
-1
lines changed

10 files changed

+248
-1
lines changed

‎.github/workflows/code-health.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,15 @@ jobs:
8888
echo "::error::Files were changed during build (see build log). If this was triggered from a fork, you will need to update your branch."
8989
cat doc.repo.patch
9090
exit 1
91+
check-purls:
92+
runs-on: ubuntu-latest
93+
permissions: {}
94+
steps:
95+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
96+
- name: Check PURLs
97+
run: make gen-purls check-purls
9198
call-acceptance-tests-workflow:
92-
needs: [build, lint, shellcheck, unit-test, generate-doc-check]
99+
needs: [build, lint, shellcheck, unit-test, generate-doc-check, check-purls]
93100
secrets: inherit
94101
uses: ./.github/workflows/acceptance-tests.yml
95102
with:

‎.github/workflows/dependabot-update-purls.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Update PURLs list for dependabot prs
2+
3+
on:
4+
pull_request
5+
6+
permissions:
7+
pull-requests: write
8+
contents: write
9+
repository-projects: read
10+
jobs:
11+
update-purls:
12+
name: Update PURLs
13+
if: github.actor == 'dependabot[bot]'
14+
uses: ./.github/workflows/run-script-and-commit.yml
15+
with:
16+
script_call: 'make gen-purls'
17+
file_to_commit: 'compliance/purls.txt'
18+
commit_message: 'chore: update purls.txt'
19+
secrets:
20+
apix_bot_pat: ${{ secrets.APIX_BOT_PAT }}
21+
remote: https://svc-apix-bot:${{ secrets.APIX_BOT_PAT }}@github.com/${{ github.repository }}
22+
gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }}
23+
passphrase: ${{ secrets.APIX_BOT_GPG_PASSPHRASE }}

‎.github/workflows/release.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,36 @@ jobs:
153153
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
154154
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
155155

156+
compliance:
157+
runs-on: ubuntu-latest
158+
needs: [ release-config, release ]
159+
if: >-
160+
!cancelled()
161+
&& needs.release.result == 'success'
162+
&& needs.release-config.outputs.is_official_release == 'true'
163+
env:
164+
SILKBOMB_IMG: ${{ vars.SILKBOMB_IMG }}
165+
steps:
166+
- name: Checkout
167+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
168+
with:
169+
ref: ${{ inputs.version_number }}
170+
- name: Generate SBOM
171+
run: make generate-sbom
172+
- name: Upload SBOM to Kondukto
173+
run: make upload-sbom
174+
env:
175+
KONDUKTO_TOKEN: ${{ secrets.KONDUKTO_TOKEN }}
176+
KONDUKTO_REPO: ${{ vars.KONDUKTO_REPO }}
177+
KONDUKTO_BRANCH_PREFIX: ${{ vars.KONDUKTO_BRANCH_PREFIX }}
178+
- name: Upload SBOM as release asset
179+
uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
180+
with:
181+
files: compliance/sbom.json
182+
tag_name: ${{ inputs.version_number }}
183+
env:
184+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
185+
156186
jira-release-version:
157187
needs: [ release-config, release ]
158188
# if release job is skipped, cancelled, or failed we do not run this job

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ bin
99
*.mdc
1010
__debug_*
1111
*~
12+
compliance/sbom.json
1213

1314
#used for schema code generation but is not commited to avoid constant updates
1415
tools/codegen/open-api-spec.yml

‎Makefile‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,3 +221,19 @@ change-lines:
221221
sed 's/${find}/${new}/' "${filename}" > "file.tmp"
222222
mv file.tmp ${filename}
223223
goimports -w ${filename}
224+
225+
.PHONY: gen-purls
226+
gen-purls: # Generate purls on linux os
227+
./scripts/generate-purls.sh
228+
229+
.PHONY: check-purls
230+
check-purls: ## Check purls
231+
./scripts/check-purls.sh
232+
233+
.PHONY: generate-sbom
234+
generate-sbom: ## Generate SBOM
235+
./scripts/generate-sbom.sh
236+
237+
.PHONY: upload-sbom
238+
upload-sbom: ## Upload SBOM
239+
./scripts/upload-sbom.sh

‎compliance/purls.txt‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
pkg:golang/cloud.google.com/go/compute/[email protected]
2+
pkg:golang/cloud.google.com/go/[email protected]
3+
pkg:golang/cloud.google.com/go/[email protected]
4+
pkg:golang/cloud.google.com/[email protected]
5+
pkg:golang/github.com/Masterminds/[email protected]
6+
pkg:golang/github.com/Masterminds/semver/[email protected]
7+
pkg:golang/github.com/Masterminds/sprig/[email protected]
8+
pkg:golang/github.com/agext/[email protected]
9+
pkg:golang/github.com/apparentlymart/[email protected]
10+
pkg:golang/github.com/apparentlymart/go-textseg/[email protected]
11+
pkg:golang/github.com/armon/[email protected]
12+
pkg:golang/github.com/aws/[email protected]
13+
pkg:golang/github.com/bgentry/[email protected]
14+
pkg:golang/github.com/bgentry/[email protected]
15+
pkg:golang/github.com/evanphx/json-patch/[email protected]
16+
pkg:golang/github.com/fatih/[email protected]
17+
pkg:golang/github.com/felixge/[email protected]
18+
pkg:golang/github.com/go-logr/[email protected]
19+
pkg:golang/github.com/go-logr/[email protected]
20+
pkg:golang/github.com/golang/[email protected]
21+
pkg:golang/github.com/golang/[email protected]
22+
pkg:golang/github.com/google/[email protected]
23+
pkg:golang/github.com/google/[email protected]
24+
pkg:golang/github.com/google/[email protected]
25+
pkg:golang/github.com/google/[email protected]
26+
pkg:golang/github.com/googleapis/[email protected]
27+
pkg:golang/github.com/googleapis/gax-go/[email protected]
28+
pkg:golang/github.com/hashicorp/[email protected]
29+
pkg:golang/github.com/hashicorp/[email protected]
30+
pkg:golang/github.com/hashicorp/[email protected]
31+
pkg:golang/github.com/hashicorp/[email protected]
32+
pkg:golang/github.com/hashicorp/[email protected]
33+
pkg:golang/github.com/hashicorp/[email protected]
34+
pkg:golang/github.com/hashicorp/[email protected]
35+
pkg:golang/github.com/hashicorp/[email protected]
36+
pkg:golang/github.com/hashicorp/[email protected]
37+
pkg:golang/github.com/hashicorp/[email protected]
38+
pkg:golang/github.com/hashicorp/hcl/[email protected]
39+
pkg:golang/github.com/hashicorp/[email protected]
40+
pkg:golang/github.com/hashicorp/[email protected]
41+
pkg:golang/github.com/hashicorp/[email protected]
42+
pkg:golang/github.com/hashicorp/[email protected]
43+
pkg:golang/github.com/hashicorp/[email protected]
44+
pkg:golang/github.com/hashicorp/[email protected]
45+
pkg:golang/github.com/hashicorp/[email protected]
46+
pkg:golang/github.com/hashicorp/terraform-plugin-sdk/[email protected]
47+
pkg:golang/github.com/hashicorp/[email protected]
48+
pkg:golang/github.com/hashicorp/[email protected]
49+
pkg:golang/github.com/hashicorp/[email protected]
50+
pkg:golang/github.com/hashicorp/[email protected]
51+
pkg:golang/github.com/huandu/[email protected]
52+
pkg:golang/github.com/imdario/[email protected]
53+
pkg:golang/github.com/jmespath/[email protected]
54+
pkg:golang/github.com/klauspost/[email protected]
55+
pkg:golang/github.com/mattn/[email protected]
56+
pkg:golang/github.com/mattn/[email protected]
57+
pkg:golang/github.com/mitchellh/[email protected]
58+
pkg:golang/github.com/mitchellh/[email protected]
59+
pkg:golang/github.com/mitchellh/[email protected]
60+
pkg:golang/github.com/mitchellh/[email protected]
61+
pkg:golang/github.com/mitchellh/[email protected]
62+
pkg:golang/github.com/mitchellh/[email protected]
63+
pkg:golang/github.com/mitchellh/[email protected]
64+
pkg:golang/github.com/mongodb-forks/[email protected]
65+
pkg:golang/github.com/mongodb/[email protected]
66+
pkg:golang/github.com/oklog/[email protected]
67+
pkg:golang/github.com/posener/[email protected]
68+
pkg:golang/github.com/shopspring/[email protected]
69+
pkg:golang/github.com/spf13/[email protected]
70+
pkg:golang/github.com/spf13/[email protected]
71+
pkg:golang/github.com/tidwall/[email protected]
72+
pkg:golang/github.com/tidwall/[email protected]
73+
pkg:golang/github.com/tidwall/[email protected]
74+
pkg:golang/github.com/tidwall/[email protected]
75+
pkg:golang/github.com/ulikunitz/[email protected]
76+
pkg:golang/github.com/vmihailenco/msgpack/[email protected]
77+
pkg:golang/github.com/vmihailenco/[email protected]+incompatible
78+
pkg:golang/github.com/vmihailenco/tagparser/[email protected]
79+
pkg:golang/github.com/wI2L/[email protected]
80+
pkg:golang/github.com/zclconf/[email protected]
81+
pkg:golang/github.com/zclconf/[email protected]
82+
pkg:golang/go.mongodb.org/atlas-sdk/[email protected]
83+
pkg:golang/go.mongodb.org/atlas-sdk/[email protected]
84+
pkg:golang/go.mongodb.org/atlas-sdk/[email protected]
85+
pkg:golang/go.mongodb.org/atlas-sdk/[email protected]
86+
pkg:golang/go.mongodb.org/[email protected]
87+
pkg:golang/go.mongodb.org/[email protected]
88+
pkg:golang/[email protected]
89+
pkg:golang/go.opentelemetry.io/auto/[email protected]
90+
pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected]
91+
pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/[email protected]
92+
pkg:golang/go.opentelemetry.io/otel/[email protected]
93+
pkg:golang/go.opentelemetry.io/otel/[email protected]
94+
pkg:golang/go.opentelemetry.io/[email protected]
95+
pkg:golang/golang.org/x/[email protected]
96+
pkg:golang/golang.org/x/[email protected]
97+
pkg:golang/golang.org/x/[email protected]
98+
pkg:golang/golang.org/x/[email protected]
99+
pkg:golang/golang.org/x/[email protected]
100+
pkg:golang/golang.org/x/[email protected]
101+
pkg:golang/golang.org/x/[email protected]
102+
pkg:golang/google.golang.org/[email protected]
103+
pkg:golang/google.golang.org/genproto/googleapis/[email protected]
104+
pkg:golang/google.golang.org/genproto/googleapis/[email protected]
105+
pkg:golang/google.golang.org/[email protected]
106+
pkg:golang/google.golang.org/[email protected]
107+
pkg:golang/google.golang.org/[email protected]

‎scripts/check-purls.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
if ! git diff --quiet --exit-code compliance/purls.txt; then
5+
echo "compliance/purls.txt is out of date. Please run 'make gen-purls' and commit the result."
6+
git --no-pager diff compliance/purls.txt
7+
exit 1
8+
fi

‎scripts/generate-purls.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
: "${LINKER_FLAGS:=}"
4+
5+
echo "==> Generating purls"
6+
7+
# Define output and temp files
8+
OUT_DIR="compliance"
9+
LINUX_BIN="${OUT_DIR}/bin-linux"
10+
DARWIN_BIN="${OUT_DIR}/bin-darwin"
11+
WIN_BIN="${OUT_DIR}/bin-win.exe"
12+
PURL_LINUX="${OUT_DIR}/purls-linux.txt"
13+
PURL_DARWIN="${OUT_DIR}/purls-darwin.txt"
14+
PURL_WIN="${OUT_DIR}/purls-win.txt"
15+
PURL_ALL="${OUT_DIR}/purls.txt"
16+
17+
# Build and extract for Linux
18+
GOOS=linux GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${LINUX_BIN}"
19+
go version -m "${LINUX_BIN}" | awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' | LC_ALL=C sort > "${PURL_LINUX}"
20+
21+
# Build and extract for Darwin
22+
GOOS=darwin GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${DARWIN_BIN}"
23+
go version -m "${DARWIN_BIN}" | awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' | LC_ALL=C sort > "${PURL_DARWIN}"
24+
25+
# Build and extract for Windows
26+
GOOS=windows GOARCH=amd64 go build -ldflags "${LINKER_FLAGS}" -o "${WIN_BIN}"
27+
go version -m "${WIN_BIN}" | awk '$1 == "dep" || $1 == "=>" { print "pkg:golang/" $2 "@" $3 }' | LC_ALL=C sort > "${PURL_WIN}"
28+
29+
# Combine, sort, and deduplicate
30+
cat "${PURL_LINUX}" "${PURL_DARWIN}" "${PURL_WIN}" | LC_ALL=C sort | uniq > "${PURL_ALL}"
31+
32+
# Clean up temp files
33+
rm -f "${LINUX_BIN}" "${DARWIN_BIN}" "${WIN_BIN}" "${PURL_LINUX}" "${PURL_DARWIN}" "${PURL_WIN}"

‎scripts/generate-sbom.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Generating SBOM..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
"$SILKBOMB_IMG" \
8+
update \
9+
--purls /pwd/compliance/purls.txt \
10+
--sbom-out /pwd/compliance/sbom.json

‎scripts/upload-sbom.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
echo "Uploading SBOMs..."
5+
docker run --rm \
6+
-v "$PWD:/pwd" \
7+
-e KONDUKTO_TOKEN \
8+
"$SILKBOMB_IMG" \
9+
upload \
10+
--sbom-in /pwd/compliance/sbom.json \
11+
--repo "$KONDUKTO_REPO" \
12+
--branch "$KONDUKTO_BRANCH_PREFIX-linux-arm64"

0 commit comments

Comments
 (0)